This vulnerability in Dokploy's volume-backups module allows any authenticated member to execute arbitrary commands on the host running the control plane. The mechanism is straightforward—unescaped user input interpolated into a child_process.exec call—but the access level required to trigger it is what makes this severe. Dokploy's architecture explicitly scopes authenticated members to managing their own applications and deployments; this CVE treats that boundary as non-existent.
If you're running Dokploy, assume the control plane can receive arbitrary input from any authenticated user. The CVSS 9.9 reflects the reality that a low-privilege member can jump directly to root-equivalent access in a single hop, not through privilege escalation or multi-step pivots. The Docker socket access mentioned in the description compounds this: even if the Dokploy process itself runs non-root, Docker's group membership or socket permissions typically grant equivalent capabilities.
The critical question for operators is whether this represents a systemic pattern in Dokploy's codebase or an isolated lapse. Examine the 0.29.13 patch—if it's surgical (single file, specific input sanitization) rather than a codebase-wide audit for exec-family calls, treat this as evidence that other injection paths may exist in untested modules. Backup, maintenance, and utility functions are consistently under-scrutinized in PaaS platforms because developers assume input is 'already validated' upstream.
For self-hosted deployments: do not assume Dokploy provides isolation between tenants or between the platform and untrusted user input. If you're sharing an instance across teams, treat each authenticated user as having full control plane access until proven otherwise.