Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.0 and earlier, the deleteRegistry function in Dokploy (packages/server/src/services/registry.ts) executes docker logout ${response.registryUrl} without shell escaping. In the same file, the docker login command correctly uses shEscape() to prevent command injection. This inconsistency creates a command injection vulnerability when deleting a registry with a crafted registryUrl.
CVSS 8.8EPSS 0.8410000000000001%Risk 0.95
View source- Published
- 2026-05-29 16:16:28
- Affected versions
- <=0.29.0
- Type
- Package
- Last modified
- 2026-07-21 15:10:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H