The vulnerability is a remote code execution flaw that allows an attacker with low‑privilege authentication on the Dokploy control plane to run arbitrary commands with host privileges. The flaw arises because the volumeName field supplied to volumeBackup.create and volumeBackup.runManually is unsafely interpolated and passed to child_process.exec without quoting. By leveraging Docker socket access, an attacker can gain root-equivalent execution on the host. The weakness is identified as CWE‑78: Command Injection, which directly exposes the system to arbitrary code execution. The impact is comprehensive: confidentiality, integrity, and availability of the entire host can be compromised, potentially leading to full system takeover.

The affected product is Dokploy, the self‑hosted Platform as a Service software. Versions older than 0.29.13 are vulnerable. The issue is present in any installation of Dokploy that allows low‑privilege members to use the volume backup function. 0.29.13 and later releases contain the fix.

The CVSS score is 9.9, indicating maximum severity. The EPSS score is not available, but the lack of a publicly disclosed exploit does not reduce the potential for opportunistic attacks. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. The attack vector is inferred to be any authenticated low‑privilege user who can invoke the volume backup API on a host with Docker socket access, which is a common configuration for self‑hosted PaaS deployments. Given the high severity and the fact that the flaw allows host‑level root execution, the risk profile is extremely high for any affected installation.