The vulnerability resides in Dokploy’s compose command handling, where sanitizeCommand only trims whitespace and strips quotes but does not escape shell metacharacters. An attacker who is authenticated and has permission to modify a Compose service can inject arbitrary shell metacharacters, allowing execution of arbitrary commands on the host. This constitutes a command injection flaw (CWE-78) that compromises confidentiality, integrity, and availability of the entire Dokploy server.

All Dokploy installations running a version earlier than v0.29.13 are affected, including any branches that have not applied the 0.29.13 patch. The flaw applies to the server component that processes user‑supplied compose commands. Administrators should verify the running version and impacted environment.

The CVSS score of 8.7 indicates high severity, and the absence of an EPSS score suggests the exploitation probability is not well documented but remains significant because the affected functionality is exposed over the PaaS management interface. The vulnerability is not listed in the CISA KEV catalog, however an authenticated user can trigger arbitrary code execution on the host through the Compose update pathway. Prompt patching reduces the risk of a host compromise by malicious insiders or compromised credentials.