Executive brief
Coolify is an open-source platform used to manage servers, applications, and databases from a single dashboard. A security flaw in the database backup system allows users with database management permissions to execute unauthorized commands on the managed servers. This could lead to limited unauthorized access or interference with server operations, though it requires high-level user privileges to exploit.
Technical details
An OS command injection vulnerability (CWE-78) exists in Coolify's DatabaseBackupJob component. The application fails to properly escape user-provided database credentials (usernames, passwords, and URIs) and MongoDB collection exclusion names before interpolating them into shell commands used for backups. An authenticated attacker with high-level database management permissions can exploit this by providing specially crafted input to execute arbitrary commands on the underlying managed servers. The attack complexity is considered high as it requires specific administrative privileges. The issue has been addressed in version 4.0.0-beta.471 by implementing proper shell escaping using functions like escapeshellarg and adding input validation for collection names.
Affected products
- coollabsio Coolify < 4.0.0-beta.471
Timeline
- 2026-03-25: patched: Fixes committed to repository
- 2026-04-09: advisory: Release v4.0.0-beta.471 published
- 2026-07-07: disclosed: CVE published to NVD
References
- https://github.com/coollabsio/coolify/commit/952f3247970d261ff93f85c79066192f58f9557e
- https://github.com/coollabsio/coolify/commit/99043600ee881fd8581185e7590604d9882382cd
- https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471
- https://github.com/coollabsio/coolify/security/advisories/GHSA-4vff-6j8j-qhcg