Dokploy allows an attacker to inject arbitrary shell commands through the appName field during application creation. The injected commands are executed with server‑level privileges when service operations such as start, stop, remove, or scale are performed. This is a classic command injection flaw, identified as CWE-78, that can lead to full system compromise. The vulnerability exists because the appName is sanitized only by replacing spaces and lower‑casing, no schema validation, and is then directly interpolated into shell commands. The impact is critical, exposing the host operating system to arbitrary execution.

The affected product is Dokploy, a self‑hostable Platform as a Service, version 0.26.6 and earlier. Users of any of these releases are vulnerable if they create or operate services with potentially malicious application names.

The CVSS score is 9.9, indicating a critical severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. An authenticated attacker who can create an application can inject characters such as ;, $(), backticks, |, and & into the appName. When the attacker later triggers a service operation, the injected command runs with the privileges of the Dokploy service, leading to complete compromise. The risk is high and the exploitation window remains open until affected installations are updated.