Dokploy allows an attacker to inject arbitrary shell commands through the dockerImage parameter supplied to its database service deployment functions. The application passes this user-controlled value unquoted into a shell command docker pull ${dockerImage}. This unchecked input enables command execution on the host, exposing the entire system to compromise. The vulnerability is a classic OS command injection (CWE‑78) and can be leveraged to exfiltrate data, modify configuration, or pivot to other services on the host.

The flaw exists in Dokploy versions prior to 0.29.13, affecting the database service deployment modules for MariaDB, MongoDB, MySQL, PostgreSQL, Redis, and libSQL. It applies to all installations using these deployment functions where dockerImage values are not sanitized.

The CVSS score of 9.9 indicates a critical severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, but the high severity rating dictates immediate attention. The attack requires the ability to submit or modify database service deployment requests, typically via authenticated access to the Dokploy administration interface. Once an attacker supplies a malicious dockerImage string, the vulnerable code executes it with the permissions of the Dokploy process, allowing full host compromise.