Executive brief
Coolify, an open-source tool for managing servers and databases, contains a security flaw in its database import feature. An authenticated user with basic team access can inject malicious commands into the system by manipulating the name of a database container. If exploited, this allows an attacker to take full control of the managed servers, potentially leading to data theft, service disruption, or unauthorized access to the entire infrastructure.
Technical details
An authenticated command injection vulnerability exists in the Database Import functionality (app/Livewire/Project/Database/Import.php) of Coolify. The '$container' Livewire public property lacks the '#[Locked]' attribute, allowing a client to modify it via the Livewire wire protocol. This property is subsequently interpolated directly into shell commands (such as 'docker exec' and 'docker cp') without sanitization or validation. An attacker with at least team-level privileges can exploit this to execute arbitrary commands as root on managed servers. This vulnerability represents a bypass of previous fixes (GHSA-q33h-22xm-4cgh) and is addressed in version 4.0.0-beta.471 by adding locked attributes and consolidating container name validation.
Affected products
- coollabsio Coolify < 4.0.0-beta.471
Timeline
- 2026-03-25: patched: Fix committed to repository
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD