Horizon Alert
Summary of the vulnerability and why it matters
A security vulnerability has been identified in Dokploy, a self-hostable Platform as a Service, that could allow an authenticated user to execute arbitrary commands on the system's control plane. This could grant them high-level access and control over the host environment.
- Low-privilege user can run commands on the host.
- Matters for PaaS users running their own infrastructure.
- Confirm relevance and exposure to Dokploy PaaS instances.
Attack Path
How an attacker could exploit the issue
An attacker with low-privilege access to Dokploy can execute arbitrary commands on the control-plane host. This occurs because the `volumeName` field for backup operations is not properly quoted, allowing it to be interpolated and executed by the server's command interpreter. With access to the Docker socket, an attacker can achieve host or root-equivalent privileges.
- Authenticated low-privilege user access is required.
- Arbitrary commands via unquoted volume name field.
- Full host control, including root access.
Live Threat
Current exploitation, exposure, and threat context
An authenticated low-privilege member could execute arbitrary commands on the control-plane host when supported by the advisory. This is because a field used for volume backups is not properly quoted and is executed via `child_process.exec`, with Docker socket access enabling host/root-equivalent execution.
- Control-plane host system data.
- Unquoted input allows command execution.
- Potential for full system compromise.
Operational Fix
Recommended remediation, mitigation, and detection steps
The critical vulnerability in Dokploy's command execution allows authenticated, low-privilege members to compromise the control-plane host via a vulnerable `volumeName` field interpolation. This issue likely impacts teams managing PaaS environments, including platform or infrastructure administrators. The initial step is to identify all Dokploy instances, confirm their accessibility and business criticality, and then determine the accountable owner for remediation planning.
- Platform/Infrastructure owners must act.
- Verify Dokploy instance reachability and criticality.
- Plan remediation with vendor coordination.
