CVE-2026-42200: Coollabsio Coolify path traversal in PostgreSQL init scripts

CVE-2026-42200 · Severity: high · CVSS 8.8 · Published 2026-07-07

Coolify, an open-source tool for managing servers and databases, contains a security flaw in how it handles database setup scripts. An authorized user could exploit this to write malicious files to unintended locations on the server. This could allow an attacker to take full control of the server by executing arbitrary commands during the database startup process.

Technologies: Coollabs Coolify. Vendors: Coollabs.

Quick answers

Is CVE-2026-42200 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42200 being exploited in the wild.
How severe is CVE-2026-42200?
High severity, with a CVSS score of 8.8, published 7 July 2026.
Which products and versions are affected?
Coollabs Coolify < 4.0.0-beta.474.
Is there a fix for CVE-2026-42200?
A patch was published on 2026-04-20: Fix committed to repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42200 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42200?
Check whether you run Coollabs Coolify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in Coolify's PostgreSQL initialization logic within the `generate_init_scripts()` method of `app/Actions/Database/StartPostgresql.php`. The application failed to sufficiently restrict or sanitize filenames for database init scripts, allowing an authenticated user to provide paths that escape the intended directory. By writing malicious scripts to sensitive locations, an attacker can achieve arbitrary command execution when the database container initializes. The fix, introduced in version 4.0.0-beta.474, implements a `validateFilenameSafe()` helper and utilizes `basename()` and `escapeshellarg()` to harden the file writing process.

Affected products

  • coollabsio Coolify < 4.0.0-beta.474

Timeline

  • 2026-04-20: patched: Fix committed to repository.
  • 2026-04-21: advisory: Release v4.0.0-beta.474 published.
  • 2026-07-07: disclosed: CVE-2026-42200 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.