Dokploy 0.28.8 and earlier contain an authenticated operating‑system command injection flaw in the application.updateTraefikConfig tRPC endpoint. The vulnerability arises from unsanitized echo shell interpolation, allowing any authenticated admin or owner to run arbitrary system commands on the remote host. This is a classic OS command injection, mapped to CWE‑78, and can compromise confidentiality, integrity, and availability of the underlying server.

The affected product is Dokploy, a self‑hostable Platform as a Service. Only versions 0.28.8 and prior are vulnerable, regardless of other platform features.

With a CVSS score of 9, this flaw provides high‑severity remote code execution to privileged users. Because it requires administrator or owner authentication, the attack surface is limited to users with elevated roles, but the repercussions of successful exploitation are severe. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is authenticated exploitation via the updateTraefikConfig endpoint.