Dokploy allows an authenticated user with certificate create or delete permission to supply a certificatePath that is concatenated with the internal certificate root without any validation. This omission permits the attacker to write arbitrary certificate files or delete files outside the intended directory, effectively enabling remote operating-system level file manipulation. The vulnerability is classified as CWE‑78, reflecting the use of an untrusted input to influence file system operations and potentially execute malicious commands.

The vulnerability exists in the Dokploy Platform as a Service, affecting all installations using versions prior to 0.29.13. Users of earlier releases are susceptible if they have the ability to create or delete certificates through the API.

With a CVSS score of 9.9 the flaw is critical. The EPSS score is not available, but the lack of a KEV listing does not diminish its severity; the required privilege level is limited to certificate create/delete rights, which while not universal ACLs still grant attackers meaningful capabilities on the host. An attacker can remotely call the vulnerable endpoint, supply a crafted certificatePath, and thereby create or eliminate files wherever the process runs, potentially leading to privilege escalation or complete system takeover.