CVE-2026-93425: Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through childprocess.exec as root in the Dokploy container. The supplied service identifier is used only to resolve the server and does not constrain repoPath. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Dokploy organization member with the service:read permission can exploit it. No user interaction is required.
What access does successful exploitation provide?
Injected commands execute as root inside the Dokploy container. In the standard deployment, the container mounts /var/run/docker.sock, allowing container-root access to control Docker and potentially compromise the host and managed applications.
Are deployments affected by default?
The described host-compromise path applies to the standard deployment because it mounts /var/run/docker.sock. The vulnerable procedure accepts a user-controlled repoPath, and the service identifier does not restrict that path.
What should be done to remediate the issue?
Upgrade Dokploy to version 0.29.13, which fixes the issue. If upgrading cannot happen immediately, restrict access for organization members with service:read permission and reduce or remove the Dokploy container's access to the Docker socket where operationally possible.