Executive brief
Coolify is an open-source platform used to manage and automate the deployment of servers, applications, and databases. A security vulnerability in how the system handles file storage paths allows an authorized user to execute malicious commands on the underlying server. By providing a specially crafted file path when adding storage to an application, an attacker can take full control of the server where Coolify is running. This could lead to the theft of sensitive data, service disruptions, or unauthorized access to managed infrastructure.
Technical details
An OS command injection vulnerability exists in Coolify's LocalFileVolume component due to improper neutralization of shell metacharacters in file storage paths. In versions prior to 4.0.0-beta.471, the 'saveStorageOnServer' method constructs shell commands (such as 'mkdir -p') using the 'fs_path' and 'parent_dir' variables before they are validated or escaped. Furthermore, the 'submitFileStorage' function in the Livewire component fails to apply 'validateShellSafePath' to user-provided file-mount paths. Because the 'LocalFileVolume' model dispatches a 'ServerStorageSaveJob' immediately upon creation, an authenticated attacker with permissions to add file storage can achieve Remote Code Execution (RCE) on the target server simply by saving a malicious path. The vulnerability is exploited via network requests to the UI or API and is fixed in version 4.0.0-beta.471 by ensuring consistent path validation and escaping.
Affected products
- coollabsio Coolify < 4.0.0-beta.471
Timeline
- 2026-03-25: patched: Fix committed to repository
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: CVE published to NVD