Executive brief
Coolify, an open-source tool for managing servers and databases, contains a security flaw in how it handles database setup scripts. An authorized user could exploit this to write malicious files to unintended locations on the server. This could allow an attacker to take full control of the server by executing arbitrary commands during the database startup process.
Technical details
A path traversal vulnerability exists in Coolify's PostgreSQL initialization logic within the `generate_init_scripts()` method of `app/Actions/Database/StartPostgresql.php`. The application failed to sufficiently restrict or sanitize filenames for database init scripts, allowing an authenticated user to provide paths that escape the intended directory. By writing malicious scripts to sensitive locations, an attacker can achieve arbitrary command execution when the database container initializes. The fix, introduced in version 4.0.0-beta.474, implements a `validateFilenameSafe()` helper and utilizes `basename()` and `escapeshellarg()` to harden the file writing process.
Affected products
- coollabsio Coolify < 4.0.0-beta.474
Timeline
- 2026-04-20: patched: Fix committed to repository.
- 2026-04-21: advisory: Release v4.0.0-beta.474 published.
- 2026-07-07: disclosed: CVE-2026-42200 published.