Dokploy’s deleteRegistry function, used in versions 0.29.0 and earlier, invokes the docker logout command without shell escaping, unlike the docker login command which correctly applies shEscape(). The registryUrl parameter is concatenated directly into the logout command, allowing an attacker to insert malicious shell syntax. When a crafted URL is supplied via the deleteRegistry API, arbitrary shell commands are executed on the host running Dokploy, providing an attacker full control over the system.

Dokploy Platform-as-a-Service, product name Dokploy, affected in all releases up to and including 0.29.0.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is not available, but the lack of a CISA KEV listing does not diminish the inherent risk. An attacker who can trigger the deleteRegistry operation—typically an authenticated user with permission to delete registries—can craft the registryUrl to execute arbitrary commands. Successful exploitation results in remote code execution, which can lead to total compromise of the host, data exfiltration, and further lateral movement.