A command‑injection flaw exists in Dokploy’s dockerImage handling within the buildRemoteDocker routine. The input string is interpolated directly into a shell command without quoting, allowing an attacker to insert shell substitutions and cause arbitrary commands to run on the host executing the build. The flaw enables the execution of any command, exposing sensitive host secrets and the contents of other projects that share the same build environment.

Dokploy Platform as a Service, versions prior to 0.29.13. The issue was addressed in release 0.29.13 and later.

The CVSS score of 9.6 marks this vulnerability as critical. While no EPSS data is published, the lack of a KEV listing does not diminish the risk of exploitation; authenticated users with application create or update rights can leverage the flaw. The vulnerability is exploitable on both local build hosts and remote SSH build targets, permitting a malicious actor to compromise the entire host system.