An authenticated user in Dokploy versions 0.28.8 and earlier can create or modify file mounts and inject shell metacharacters into the filePath field. The application then passes this unsanitized value to a system shell on the remote managed server via SSH, allowing the attacker to execute arbitrary commands. This flaw satisfies CWE‑78 – System Command Injection, and grants the attacker full control over the remote host, compromising confidentiality, integrity, and availability.

The vulnerability affects the Dokploy Platform as a Service (PaaS) software, specifically the dokploy product. Any installation running version 0.28.8 or earlier is susceptible. Operators must be aware that users who can manage file mounts for services are required to be authenticated; therefore only accounts with creation or updating privileges on services are potential attack vectors.

The CVSS score of 9.9 places this flaw at critical severity, indicating a high likelihood of exploitation and a substantial impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the exploitation path is clear: an attacker logging into the web interface, assigning a malicious filePath, and triggering an SSH command on the managed server. The necessity of authentication means the attacker must first compromise or be granted access to a Dokploy account, but once privileged, the resulting remote host RCE is immediate and complete.