Dokploy is a self‑hosted platform‑as‑a‑service that allows users to configure Traefik remotely. The writeTraefikConfigRemote function serializes incoming user data into YAML, then interpolates that YAML string into an echo command executed via SSH on a managed host. Maliciously crafted YAML that contains single quotes in redirect regex, replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and inject arbitrary commands. The attacker thus gains the privileges of the configured SSH user on the remote server, potentially compromising confidentiality, integrity, and availability.

Versions of Dokploy released before 0.29.13, specifically the server component packages/server/src/utils/traefik/application.ts, are affected. Administrators using any deployment of Dokploy that has not applied the hotfix in 0.29.13 are vulnerable.

The CVSS score of 9.9 indicates critical severity. The EPSS score is not available, and the vulnerability is not listed in KEV, but the nature of the shell injection and the privileged access via SSH make exploitation realistic. The likely attack vector is a client or malicious actor that can trigger the writeTraefikConfigRemote endpoint, such as a compromised deployment client or a malicious website owner, and that has valid SSH credentials to the managed host.