Dokploy’s getRegistryCommands() function was building a shell command by directly inserting the registry password and URL. An attacker who can configure project registry credentials can inject shell code, causing the swarm deployment process to execute arbitrary OS commands on the host. This can lead to read or modification of host files, illicit access to other containers via Docker, and full compromise of the Dokploy instance. The weakness is a classic command injection flaw, CWE‑78.

The affected product is the Dokploy Platform as a Service (PaaS). Any installation of Dokploy prior to version 0.29.8 is vulnerable, regardless of the specific environment or host configuration. Versions 0.29.8 and later contain the fix and are not affected.

The CVSS score of 9.4 marks the issue as critical, but the EPSS score is not available, indicating that a precise exploitation likelihood is unknown. The vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated project users who can edit registry credentials; once such a role is obtained, they can trigger a swarm deployment that will run the injected command. Because this requires only standard Docker and cluster privileges, the risk to the host is high, and the potential impact spans confidentiality, integrity, and availability of the entire system.