A flaw in Dokploy’s backup and restore utilities allows an authenticated administrator to embed arbitrary shell commands within database configuration fields. The vulnerability arises from unsanitized interpolation of database names, usernames, and passwords into shell strings that are executed by child_process.exec(). The flaw permits attackers to run arbitrary commands inside PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL containers, potentially exposing database credentials and data and enabling container escape when the container has excessive privileges.

Dokploy Dokploy versions prior to 0.29.13 are affected. Users running the PaaS application with an authenticated administrator account that has permission to configure database backups and restores are susceptible.

The CVSS score of 6.4 indicates moderate severity, while no EPSS score is currently available. This vulnerability is not listed in the CISA KEV catalog. Exploitation requires legitimate administrative access and the privilege to intervene in database configuration, thus the attack vector is likely restricted to internal administrators or privileged attackers with such access.