Executive brief
Coolify is an open-source platform used to manage and deploy servers, applications, and databases. A security flaw allows an authorized user to break out of the restricted environment intended for application builds and execute commands directly on the underlying server. This could lead to a total takeover of the managed server, allowing an attacker to steal sensitive data, modify applications, or disrupt services.
Technical details
An OS command injection vulnerability exists in the `executeInDocker()` helper function within `bootstrap/helpers/docker.php`. The function wraps user-provided commands in single quotes for execution via `bash -c` but fails to escape embedded single quotes. An authenticated attacker with permissions to edit application settings can inject a single quote into the `docker_compose_custom_build_command` or `docker_compose_custom_start_command` fields. This terminates the quoted string and allows the execution of arbitrary shell commands on the managed server host with the privileges of the SSH user (often root). The vulnerability is reachable via the API (PATCH /api/v1/applications/{uuid}) or the Livewire UI. The issue is resolved in version 4.0.0-beta.469 by implementing proper single-quote escaping.
Affected products
- coollabsio Coolify < 4.0.0-beta.469
Timeline
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD