Dokploy, a self-hosted PaaS platform, includes an endpoint that builds a shell command by inserting a user‑supplied password into it without proper escaping. An authenticated user who can call registry.testRegistry or registry.testRegistryById can inject arbitrary shell commands that run with the privileges of the Dokploy process, giving the attacker full control over the target or connected SSH server. This represents a classic command injection flaw (CWE‑78) and results in remote code execution.

The vulnerability exists in all Dokploy deployments running a version earlier than 0.29.13. The fix was released in the 0.29.13 release, so any install that has not been updated against that milestone is potentially affected.

The CVSS score of 9.9 indicates critical severity. Although an EPSS value is not available, the flaw is fully exploitable by anyone with legitimate authentication credentials on the Dokploy instance, and because the attacker can run arbitrary commands on the host or connected SSH server, the impact extends to confidentiality, integrity, and availability. The vulnerability is not currently listed in CISA’s KEV catalog, but the high CVSS and ease of exploitation make it a priority for remediation.