Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the /listen-deployment WebSocket end…

Dokploy, a self-hostable Platform as a Service (PaaS), contains an authenticated OS command injection vulnerability in versions 0.28.8 and earlier. The vulnerability exists in the /listen-deployment WebSocket endpoint and allows any organization member to execute arbitrary system commands on remote servers managed by Dokploy. This vulnerability can lead to full server compromise of affected systems. The flaw affects the WebSocket communication mechanism used for deployment monitoring.