Executive brief
Coolify, an open-source tool for managing servers and databases, contains a security flaw in its certificate management feature. An authenticated user can execute malicious commands on the underlying server host. Because Coolify typically operates with high-level system permissions (root or Docker group), an attacker could gain full control over the server and all hosted applications, leading to total data exposure or service disruption.
Technical details
An OS command injection vulnerability exists in the `saveCaCertificate()` function within `app/Livewire/Server/CaCertificate/Show.php`. The application uses `openssl_x509_read()` to validate user-supplied certificates, but this only checks content up to the 'END CERTIFICATE' marker, allowing attackers to append malicious shell commands. These commands are subsequently passed unsanitized to `writeCertificateToServer()`, which executes them via an `echo` shell command. An attacker with low-level authenticated access can exploit this to achieve Remote Code Execution (RCE) as the configured SSH user (typically root or a member of the docker group). The issue is resolved in version 4.0.0-beta.464 by properly re-serializing the certificate content.
Affected products
- coollabsio Coolify < 4.0.0-beta.464
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: NVD publication date