Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists because user-controlled input is used to construct shell commands without proper escaping. The patch applies the shell-quote library across the application to mitigate this. The core of the vulnerability lies in several tRPC router endpoints and their underlying service functions that build and execute shell commands for operations like backups, restores, and other system interactions. An authenticated administrator could provide crafted input to these functions, such as a malicious database name or backup path, to inject and execute arbitrary commands on the host system. The analysis of the commit d02f34f9d48b363b9bf15a948e263ff4ebfcceda clearly shows the addition of quote() calls in numerous locations where shell commands are constructed, confirming the widespread nature of this command injection vulnerability.
backupRouter.listapps/dokploy/server/api/routers/backup.ts
destinationRouter.checkapps/dokploy/server/api/routers/destination.ts
restoreWebServerBackuppackages/server/src/utils/restore/web-server.ts
runCommandpackages/server/src/utils/schedules/utils.ts
rebuildDatabasepackages/server/src/utils/databases/rebuild.ts
restoreVolumepackages/server/src/utils/volume-backups/restore.ts
restoreComposeBackuppackages/server/src/utils/restore/compose.ts