Dokploy: unquoted volumeName in volume backups gives root-equivalent execution on the control-plane host

Impact

The volumeName accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting into a command passed to child_process.exec, so a low-privilege authenticated member executes arbitrary commands on the Dokploy control-plane host. Because that process holds Docker socket access, the execution is host- and root-equivalent: every container on the box, every tenant's data, and the host filesystem. This is a separate code path and a separate commit from the Docker-build and registry-credential injections fixed in the same release, so patch verification should not stop at one of them.

Who can reach it

Network access to the Dokploy API with any authenticated low-privilege member account that can create or manually run a volume backup. No admin role required.

What to do

Upgrade to Dokploy 0.29.13 and restart the Dokploy stack (fix in commit d629fae). No mitigation short of the upgrade is published; disabling volume backups is not documented as a supported workaround. The restart interrupts in-flight deploys. Given Docker-socket-level impact on a shared instance, rotate host-reachable secrets afterwards.

References

Related entries

• KubeVirt: Improper symlink validation in virt-handler lets a user with edit rights in one namespace escape to the hostCVE-2026-7374 · KubeVirtCritical
• Helm: Improper certificate validation allows unauthorized clients to connect to TillerCVE-2019-1010275 · HelmCritical
• Docker / moby: Code injection into `docker cp` via nsswitch loading a library from the container chrootCVE-2019-14271 · Docker / mobyCritical
• Helm: Malicious chart includes sensitive host content such as /etc/passwd, or triggers DoS, when loadedCVE-2019-18658 · HelmCritical
• Envoy: HTTP/2 request writes to the heap outside request buffers when the upstream is HTTP/1CVE-2019-18801 · EnvoyCritical
• Envoy: Header whitespace handling enables request smuggling and authorization bypassCVE-2019-18802 · EnvoyCritical