The vulnerability exists in the patch.readRepoDirectories procedure of Dokploy, where a user‑controlled repoPath is interpolated directly into a shell command without proper quoting. An attacker who is an authenticated organization member with service:read permission can inject shell metacharacters, causing child_process.exec to run arbitrary commands as root inside the Dokploy container. This flaw permits full exploitation of the container, potentially allowing the attacker to gain control over the host system or any containers it manages.

Affected products include Dokploy Platform as a Service (PaaS) deployed in versions earlier than 0.29.13. The vulnerability is fixed starting with the 0.29.13 release.

The CVSS score of 9.9 indicates a critical level of severity. Because the Exploit Prediction Scoring System value is not available and the vulnerability is not currently listed in the CISA KEV catalog, the immediate public threat level is uncertain. However, the fact that any authenticated organization member with service:read permission can execute commands as root makes exploitation relatively straightforward in environments where such permissions are granted broadly. The ability to control Docker through the exposed /var/run/docker.sock mount further increases the potential for host compromise.