Executive brief
Coolify, an open-source platform for managing servers and applications, contains a security flaw that allows users with high-level administrative access to bypass container security boundaries. By providing specially crafted commands in the custom build or start fields, an authorized user can execute arbitrary code directly on the underlying host server rather than within the intended isolated Docker container. While this requires significant existing privileges, it allows an attacker to gain deeper access to the server infrastructure than normally permitted.
Technical details
A command injection vulnerability exists in Coolify's `executeInDocker()` helper function within `bootstrap/helpers/docker.php`. The function wraps commands in `bash -c '{$command}'` without properly escaping single quotes, allowing for a breakout of the bash argument string. Specifically, the `docker_compose_custom_build_command` and `docker_compose_custom_start_command` fields in `ApplicationDeploymentJob.php` are interpolated directly into this helper. An attacker with high privileges (API write scope and application update authorization) can inject a single quote to terminate the intended command and execute arbitrary OS commands on the managed server host. This issue is resolved in version 4.0.0-beta.464 by implementing proper string escaping.
Affected products
- coollabsio Coolify < 4.0.0-beta.464
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: CVE published to NVD
- 2026-06-30: patched: Fix released in version 4.0.0-beta.464