Executive brief
Coolify is an open-source platform used to manage and deploy servers, applications, and databases. A security flaw in its development settings allows an administrator to execute unauthorized commands on the underlying server by providing a specially crafted version string. While this requires high-level access and specific environment conditions, it could lead to full server takeover or data theft in development setups.
Technical details
An OS command injection vulnerability exists in the `buildHelperImage` method within `app/Livewire/Settings/Index.php`. The application constructs a Docker build command by interpolating the `dev_helper_version` field directly into a shell string without proper escaping or validation. An attacker with high privileges can modify this field to include shell metacharacters (e.g., semicolons or pipes) and then trigger the build process. Although the vulnerability is restricted to environments where `isDev()` returns true, it allows for arbitrary command execution via the `remote_process` function. The issue was resolved in version 4.0.0-beta.474 by implementing strict regex validation for Docker tags and using `escapeshellarg()` for shell interpolation.
Affected products
- coollabsio Coolify < 4.0.0-beta.474
Timeline
- 2026-04-20: patched: Fix committed to repository
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: CVE published to NVD