Dokploy password check allows backtick, yields root RCE

A database password change in Dokploy v0.31.0 can run attacker-chosen shell commands as root inside the container that holds the host Docker socket, according to a report posted to the oss-security list. The author, writing as theknell, scored it 9.9 on the vendor's own vector and said the bug was live-proven against the official image.

Dokploy is a self-hosted panel with about 38,000 GitHub stars and 514 official templates. By design it is the most trusted process on the machines it manages: root on every server in the fleet, the Docker socket, and the credentials of every database and application it deploys.

The password check, in the code since v0.29.0, rejects dollar signs, exclamation marks, quotes, backslashes, slashes and spaces. It still allows the backtick, and with it semicolons, pipes, ampersands, parentheses and redirects. In the Postgres and MySQL password-change paths the new value is placed in single quotes nested inside a double-quoted shell argument, where bash still performs command substitution. A password made of a backtick command and a redirect, using none of the banned characters, therefore runs as uid 0 in that server container.

The database username has no character check beyond a minimum length and is passed to Postgres unquoted. A semicolon there is a full command sequence, with no substitution trick, and the field can be set at creation or on update of a deployed service.

The MariaDB and Mongo password-change paths match that shape in source; they were not separately executed. The Redis path does not fire, because its password sits in top-level single quotes. The reporter treats that difference as the control that confirms the mechanism.

On a localhost-bound official v0.31.0 image, a benign password change returned success, a password using dollar-parenthesis substitution was rejected, and a backtick password was accepted and left a canary file reading uid 0 and gid 0 inside the server container. The run was repeated from a clean container. Backtick and semicolon usernames fired the same way, as did the MySQL password path as a second sink. The report frames the issue as a member's password change becoming host remote code execution, because that container holds the host Docker socket.