CVE-2026-93425

Executive Summary

CVE-2026-93425 is a critical OS command injection vulnerability in Dokploy, a free self-hostable Platform-as-a-Service (PaaS) product, affecting all versions prior to 0.29.13. The flaw resides in the patch.readRepoDirectories tRPC procedure, which passes a user-controlled repoPath value into a shell command without safe argument quoting. An authenticated organization member holding only the low-privileged service:read permission can inject shell metacharacters to execute arbitrary commands as root inside the Dokploy container, and because the standard deployment mounts /var/run/docker.sock, this yields control over the Docker daemon and consequently the host and all managed applications.

Technical Analysis

Dokploy is a self-hostable PaaS that manages application deployments on behalf of its users. The vulnerability is a classic CWE-78 OS Command Injection located in the patch.readRepoDirectories tRPC procedure. According to the NVD description, the tRPC procedure defined in apps/dokploy/server/api/routers/patch.ts passes the user-controlled repoPath value into a shell command implemented in packages/server/src/services/patch-repo.ts without safe argument quoting.

The core defect is that repoPath is interpolated into a command string that is subsequently executed via child_process.exec. The Node.js child_process.exec function invokes a shell (/bin/sh -c), meaning that any shell metacharacters (;, &&, |, backticks, $(), etc.) contained within repoPath are interpreted by the shell rather than treated as literal path data. Because no escaping or argument-array invocation (e.g., execFile/spawn with shell: false) is used, an attacker who controls repoPath effectively controls the command line executed by the shell.

Two authorization details amplify the severity of this flaw. First, the required privilege is only service:read, which is granted to ordinary authenticated organization members — not administrators. This makes the vulnerability reachable by a broad, low-trust population of users in any shared Dokploy organization. Second, the service identifier supplied in the request is used solely to resolve which server the operation targets; it does not constrain or validate the repoPath value. In other words, the intended scoping control does not limit the attacker's input, leaving repoPath as a fully attacker-controlled taint source feeding a shell sink.

The execution context is highly privileged. The shell command runs via child_process.exec as root within the Dokploy container. Combined with the standard deployment practice of mounting /var/run/docker.sock into the container, container-root command execution translates directly into control of the Docker daemon. From there an attacker can start/stop containers, mount host filesystems into privileged containers, and escalate to full host compromise.

No CVSS vector metadata for environmental or temporal modifiers is provided beyond the base vector. The base score is 9.9 (Critical). The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates network exploitable (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and a changed scope (S:C) — reflecting that compromise escapes the vulnerable component's original security scope into the host/Docker layer. Confidentiality, Integrity, and Availability impacts are all High.

CWE classification is CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-93425. The attack chain below is derived strictly from the NVD description and the vulnerability class. No specific payload strings, endpoints beyond those named, or implementation details have been invented.

1. Reconnaissance / target identification. An attacker identifies an internet- or network-exposed Dokploy instance (versions < 0.29.13). This is a self-hostable PaaS, so exposed instances are discoverable via web content signatures. The attacker must be able to authenticate to the instance as an organization member.

2. Prerequisite access. The attacker has a valid account that is a member of an organization with at least the service:read permission. This is a low-privilege role, and the CNA description explicitly states that the supplied service identifier is used only to resolve the server — it does not constrain repoPath. The attacker locates or controls a service identifier valid for their scope.

3. Triggering the flaw class (command injection). The attacker invokes the patch.readRepoDirectories tRPC procedure, supplying a repoPath value containing shell metacharacters. Because repoPath is interpolated into a shell command without safe quoting and executed through child_process.exec, the shell interpreter parses the injected metacharacters as additional commands. This is the generic command-injection mechanism; the precise metacharacters required depend on the surrounding command construction, which is not detailed in the available data.

4. Execution and post-exploitation impact. The injected command executes as root inside the Dokploy container. Because the standard deployment mounts /var/run/docker.sock, the attacker can interact with the Docker daemon — enumerate containers, create privileged containers that mount host paths, and thereby compromise the host and the applications Dokploy manages. The result is a full confidentiality, integrity, and availability breach extending beyond Dokploy itself (consistent with the S:C scope change in the CVSS vector).

Impact Assessment

The CVSS base score is 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The subscores indicate:

• Attack Vector (Network): exploitable remotely against a reachable Dokploy instance; no adjacent or local access required.
• Attack Complexity (Low): no unusual conditions beyond authenticated access and controlled input.
• Privileges Required (Low): only service:read, an ordinary member permission, is needed.
• User Interaction (None): exploitation requires no victim action.
• Scope (Changed): the impact escapes the vulnerable component and extends to the host/Docker substrate, which is why scope is Changed rather than Unchanged.
• Confidentiality / Integrity / Availability (High): root command execution in a container with Docker socket access enables reading sensitive data, altering deployments, and disrupting services.

Business impact is severe for organizations running Dokploy to manage production workloads. Because /var/run/docker.sock is mounted in the standard deployment, container-root command execution is effectively host-root: managed applications, their data, deployment pipelines, and any secrets reachable from the host are all within blast radius. The low privilege requirement means any authenticated organization member — including a low-trust collaborator or a compromised member account — can escalate to host control, making the insider-threat and account-takeover surfaces significant. Multi-tenant Dokploy deployments are especially exposed, since one low-privileged member in one organization can potentially affect shared infrastructure.

Detection Guidance

Sigma Rule

title: Dokploy repoPath Command Injection via patch.readRepoDirectories
id: 8f3c1a2e-7d4b-4c9a-9e21-6b0f5a9d3c11
status: experimental
description: Detects exploitation attempts of CVE-2026-93425 where shell metacharacters are injected into the repoPath value of the patch.readRepoDirectories tRPC procedure in Dokploy.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93425
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_proc:
    cs-uri-query|contains: 'patch.readRepoDirectories'
  selection_meta:
    cs-uri-query|contains:
      - ';'
      - '&&'
      - '||'
      - '|'
      - '$('
      - '`'
  selection_repo:
    cs-uri-query|contains: 'repoPath'
  condition: selection_proc and selection_repo and selection_meta
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate repository paths containing shell metacharacters (rare)
level: high

YARA Rule

rule CVE_2026_93425_Dokploy_Command_Injection
{
    meta:
        description = "Detects shell metacharacter injection targeting the repoPath parameter of Dokploy patch.readRepoDirectories (CVE-2026-93425)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93425"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $t1 = "patch.readRepoDirectories" ascii nocase
        $t2 = "repoPath" ascii nocase
        $semi = ";" ascii
        $amp = "&&" ascii
        $pipe = "|" ascii
        $dollar = "$(" ascii
        $backtick = "`" ascii

    condition:
        uint16(0) == 0x457F or filesize < 10MB
        and $t1 and $t2
        and any of ($semi, $amp, $pipe, $dollar, $backtick)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93425 Dokploy repoPath Command Injection Attempt"; flow:established,to_server; http.uri; content:"patch.readRepoDirectories"; nocase; http.uri; content:"repoPath"; nocase; http.uri; pcre:"/(repoPath[^&]*(%3B|%26%26|%7C|%60|%24%28))/i"; classtype:web-application-attack; reference:cve,2026-93425; sid:202693425; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.type == "start" and process.parent.name in ("node", "sh", "bash") and process.name in ("sh", "bash")]
  [process where event.type == "start" and process.name in ("docker", "curl", "wget", "nc", "ncat") and process.parent.name in ("sh", "bash", "node")]

Splunk SPL Query

index=web OR index=proxy
| search uri="*patch.readRepoDirectories*" AND uri="*repoPath*"
| regex uri="(?i)(repoPath[^&]*(%3B|%26%26|%7C|%60|%24%28|;|&&|\||\`))"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, user_agent, status
| sort -count

Wazuh OSSEC Rule

<group name="dokploy,web,attack,">
  <rule id="2026934" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>patch.readRepoDirectories</match>
    <regex>repoPath.*(%3B|%26%26|%7C|%60|%24%28|;|&&|\|)</regex>
    <description>CVE-2026-93425: Dokploy repoPath shell metacharacter injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_93425,command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network access to Dokploy management interfaces to trusted networks/VPNs; do not expose the tRPC API to the public internet.
   • Audit organization membership and service:read grants; remove untrusted or unnecessary members from Dokploy organizations, since exploitation requires only this low privilege.
   • Where feasible, avoid mounting /var/run/docker.sock into the Dokploy container. If Docker control is required for functionality, isolate it strongly (rootless Docker, gVisor/Kata containment, or a broker that filters Docker API calls) to break the container-root-to-host escalation path.
   • Apply a WAF/reverse-proxy rule that blocks requests to patch.readRepoDirectories containing shell metacharacters in repoPath.

2. Patch/upgrade steps

   • Upgrade Dokploy to version 0.29.13 or later, where the unsafe quoting in packages/server/src/services/patch-repo.ts invoked by the patch.readRepoDirectories procedure is corrected. Note that the vendor fix is not confirmed by any tracked patch source in this dataset; validate the fixed version against the vendor's official release notes before relying on it.

3. Long-term hardening

   • Remediate the underlying code pattern: replace shell-string execution (child_process.exec) with argument-array invocation (execFile/spawn with shell: false) so user-controlled input is never interpreted by a shell.
   • Enforce strict server-side validation of repoPath (allowlisting and path canonicalization) rather than relying on the service identifier as a scoping control.
   • Apply least privilege to container runtimes: run Dokploy as a non-root user, avoid privileged mounts, and restrict Docker socket exposure.
   • Monitor and alert on anomalous child processes spawned from the Dokploy Node.js process, especially docker, sh, and network utilities.

References

• NVD — CVE-2026-93425: https://nvd.nist.gov/vuln/detail/CVE-2026-93425
• Dokploy project (self-hostable PaaS): https://github.com/Dokploy/dokploy
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• CISA Known Exploited Vulnerabilities catalog (check for future addition; not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (score not yet assigned at time of writing): https://www.first.org/epss/

No public proof-of-concept, Nuclei template, or exploit code was available at the time of writing, and there is no evidence of exploitation in the wild or attribution to a known threat actor campaign in the provided data.