A user with the traefikFiles.read permission can submit a path to the settings.readTraefikFile API endpoint. That path is interpolated directly into a shell command (cat ${configPath}), allowing the attacker to inject shell metacharacters and execute arbitrary commands on the managed server. This is a classic command injection flaw, classified as CWE‑78. Based on the description, it is inferred that the vulnerability arises from unsanitized user input being passed to a shell invocation. The resulting impact is full remote code execution, compromising confidentiality, integrity, and availability of the affected system.

The vulnerability exists in Dokploy, a self-hostable Platform as a Service, in all releases prior to version 0.29.13. These releases expose the settings.readTraefikFile endpoint and lack protection against command injection. Based on the description, it is inferred that a user with traefikFiles.read rights can exploit it. Therefore any instance of Dokploy running a pre‑0.29.13 version is vulnerable if such permissions are granted.

The CVSS score of 8.8 classifies this flaw as high severity. The EPSS score is not available, so current data does not indicate a readily exploitable attack vector, yet the lack of a KEV listing suggests no documented exploitation to date. Based on the description, it is inferred that the likely attack path requires a user with traefikFiles.read permission to supply a crafted path containing shell metacharacters; the server then executes those commands in the context of the daemon. This highlights that the vulnerability can be leveraged if an attacker has the necessary permissions and access to the API endpoint. The high severity combined with the potential for broad impact underscores the need for immediate remediation.