In Dokploy versions 0.29.1 and earlier, the Docker file upload feature allows an authenticated user to supply a destinationPath that is not validated and is directly inserted into a shell command. This flaw permits command injection, enabling the attacker to escape the intended docker cp operation and run arbitrary operating‑system commands on the host, resulting in full control over the server. The weakness is described by CWE‑77.

Dokploy, the free, self‑hostable Platform as a Service, is impacted in all releases up to and including 0.29.1. Users deploying these versions should verify whether they are exposed to the file upload capability and identify the presence of the vulnerable code path.

The CVSS base score is 9.9, indicating critical impact and remote availability. Although an EPSS value is not provided, the lack of mitigation information and the high CVSS suggest that exploitation is likely in environments where the file upload endpoint is reachable by an authenticated user. The vulnerability is not listed in the CISA KEV catalog, but the combination of authentication requirement and executable command injection makes the risk substantial for any organization running the affected Dokploy versions.