H3-2026-1084¶
Dokploy Compose Domain Service Name Command Injection
| Category | VULNERABILITY |
| Base Score | 9.9 |
Description¶
Dokploy's writeDomainsToCompose function builds a shell echo command by interpolating the user supplied serviceName field through error.message without escaping it. Remote attackers who can reach the compose domain management API can set serviceName to a command substitution payload that is embedded unescaped into the generated compose deploy script. When Dokploy executes the compose deployment, the injected shell command runs as root on the underlying host. The self registration endpoint exposed by default on new Dokploy instances provides the API access needed to reach the vulnerable domain.create call.
Impact¶
Remote attackers gain command execution as root on the Dokploy host. This enables full system compromise, data exfiltration, and lateral movement into connected infrastructure. Every container and compose deployment managed by the instance becomes reachable. Organizations running Dokploy as a deployment control plane face complete loss of host integrity.