Dokploy, a self‑hosted Platform as a Service, contains a command injection flaw in the cloneGitRepository function. Prior to version 0.29.13 the function concatenates an unescaped customGitUrl and customGitBranch into a git clone command that is executed with execAsync or execAsyncRemote. An attacker who has authenticated application access can supply a malicious Git URL that contains shell metacharacters; when the deployment is triggered the server runs those characters as operating‑system commands, giving the attacker arbitrary code execution on the host system. The vulnerability is a classic example of CWE‑78, which can undermine confidentiality and integrity of the entire platform.

The issue affects all deployments of Dokploy that are running any version prior to 0.29.13. The vulnerability exists in the server side code packages/server/src/utils/providers/git.ts. The affected product is Dokploy itself, a free self‑hostable PaaS platform. Upgrade to v0.29.13 or later to eliminate the flaw.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the user be authenticated with application access. Because the attacker can control the Git URL passed to the server, any malicious payload crafted into that URL will be executed on the host. The lack of input sanitization or escaping in the clone command makes this threat realistic for users that enable custom Git repositories.