CVE-2026-129433: Dokploy before 0.31.1 OS Command Injection via Compose Backup serviceName

Q: Who can exploit this issue?

An authenticated Dokploy organization member can exploit it. No user interaction is required, but the attacker must be able to create or update a backup through the backup.create or backup.update tRPC procedures.

Q: When does the injected command execute?

The malicious serviceName value is stored first and is executed when scheduled backups run. This means exploitation may be delayed until the relevant backup schedule is triggered.

Q: What level of access can successful exploitation provide?

Injected commands execute as root. The mounted Docker socket can then be used to take over the host.

Q: Which versions are affected?

Dokploy versions before 0.31.1 are affected.

Published Nov 14, 2026

Updated

Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows authenticated organization members to execute shell commands via the serviceName parameter. Attackers can store serviceName values with shell metacharacters through backup.create or backup.update tRPC procedures, executing commands as root when scheduled backups run and taking over the host via the mounted Docker socket.

Affected Software

1 affected component

Dokploy Dokploy<0.31.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Dokploy to a version that resolves this vulnerability.
Fixed in 0.31.1

Event History

Nov 14, 2026

CVE Published

via MITRE·12:32 PM

Data Sourced

via MITRE·12:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Dokploy organization member can exploit it. No user interaction is required, but the attacker must be able to create or update a backup through the backup.create or backup.update tRPC procedures.

When does the injected command execute?

The malicious serviceName value is stored first and is executed when scheduled backups run. This means exploitation may be delayed until the relevant backup schedule is triggered.

What level of access can successful exploitation provide?

Injected commands execute as root. The mounted Docker socket can then be used to take over the host.

Which versions are affected?

Dokploy versions before 0.31.1 are affected.

CVE-2026-129433: Dokploy before 0.31.1 OS Command Injection via Compose Backup serviceName

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

When does the injected command execute?

What level of access can successful exploitation provide?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

When does the injected command execute?

What level of access can successful exploitation provide?

Which versions are affected?