The database password validator has contained the described behavior since v0.29.0. The issue was tested against the official Dokploy v0.31.0 image.
The report describes exploitation through the Postgres or MySQL changePassword procedures by a member able to change a database password. The supplied password must pass the validator; backticks are allowed despite several other shell-sensitive characters being blocked.
The injected command executes as the Dokploy server process. In the tested deployment, that process ran as root inside a container with access to the host Docker socket.
No. The report states that databaseUser has no validator beyond a non-empty string requirement and reaches Postgres unquoted. It specifically identifies a semicolon in the username as relevant to the reported injection path.