Dokploy, a self-hosted Platform as a Service, allows an authenticated user with backup‑restore permission to embed operating‑system commands into the databaseName and backupFile fields of a restore request. The application constructs shell pipelines from these unfiltered inputs, enabling the execution of arbitrary code on the host through execAsync and execAsyncRemote. This vulnerability is a classic operating‑system command injection (CWE‑78) that can compromise the entire system. The potential impact includes full system takeover, data theft, or destruction.

All Dokploy installations running a version earlier than 0.29.13 are affected. The flaw exists in the restore utilities that build database‑specific restore commands and rclone paths from the unvalidated databaseName and backupFile parameters. No specific vendor product list beyond Dokploy is required to identify impacted systems.

The vulnerability has a CVSS score of 9.9, indicating critical severity. No EPSS score is published, so the likelihood of exploitation is unknown, but the flaw is not listed in the CISA KEV catalog. Attackers must first gain authenticated access with backup‑restore permission, which is typically granted to administrators or power users. Once authorized, the attacker can trigger the vulnerable pipeline and execute arbitrary commands in the host context, potentially leading to full system compromise.