Dokploy, a self‑hosted Platform as a Service, permits authenticated application editors to construct Docker images. The flaw occurs when the dockerContextPath value is concatenated directly into an unquoted shell "cd" command that is later executed with execAsync. This omission allows an attacker who can supply a custom dockerContextPath to inject and run arbitrary shell commands on the Dokploy host, thereby compromising confidentiality, integrity, and availability.

All releases of Dokploy earlier than 0.29.13 contain this vulnerability. The issue resides in the server‑side build utilities referenced by any application that utilizes the Dockerfile builder. Users should verify their installed version against the release notes on the project’s GitHub releases page.

The flaw provides full remote code execution on the host system. Exploitation requires authentication with application‑editor privileges and the ability to supply a custom dockerContextPath. EPSS data is currently unavailable and the vulnerability is not listed in the CISA KEV catalog, yet the high‑impact nature of command injection warrants immediate remedial action. Patching to 0.29.13 eliminates the risk; before that, systems remain at high risk.