Technical impact
Dokploy prior to version 0.31.1 contains an OS command injection flaw in the getComposeContainerCommand() function. The flaw allows an attacker to embed shell metacharacters in the serviceName parameter, which is later executed as root when the backup process runs. This results in full host compromise through the Docker socket, enabling unrestricted system control on the target machine.
Affected Systems
Affected systems are installations of Dokploy from any vendor that were running a version older than 0.31.1. The vulnerability is present in all product releases before 0.31.1 regardless of minor version specifics. Users running any unsupported or self‑hosted Dokploy instance before this release are potentially impacted.
Risk and Exploitability
The CVSS score is 9.4, indicating a critical severity. The EPSS score is not available, but the absence of a low EPSS value does not mitigate the high 9.4 score. The vulnerability is not yet listed in the CISA KEV catalog, yet the flaw can be leveraged by any authenticated organization member with backup privileges. Attackers can trigger the execution by creating or updating a backup through the .create or .update tRPC procedures, causing the malicious serviceName to be interpreted when the backup job runs. The exploitation path requires login to the Dokploy UI or API and access to backup creation or update actions, after which the container runs the injected command under root privileges via the shared Docker socket.
