Security · High impactFan score 42 · Tier B
Dokploy: the validator allows the backtick — a member's database password change is host RCE, 9.9 on the vendor's own vector (v0.31.0, live-proven)
The Brief
- Dokploy's input validator allows a backtick character when a member changes a database password.
- The source reports that this lets a member achieve remote code execution on the host, scored 9.9 on the vendor's own vector.
- The issue was demonstrated live on v0.31.0 and posted to oss-sec on Nov 9.
Why it matters
Dokploy holds root on every managed server, the Docker socket, and the credentials of deployed databases and applications, so host RCE from a low-privilege member can compromise the whole fleet.
Who’s affected
- Teams running self-hosted Dokploy v0.31.0
Posted by theknell on Nov 09 Dokploy's pitch is a self-hosted panel that holds the keys to everything it manages: root on every server in the fleet, the Docker socket, and the credentials of every database and application it deploys. 38,000 stars, 514 official templates. The…
Timeline
Vulnerability posted to oss-sec by theknell
Open Source Security
Dokploy: the validator allows the backtick — a member's database password change is host RCE, 9.9 on the vendor's own vector (v0.31.0, live-proven)