Executive brief
Coolify is an open-source platform used to manage and deploy servers, applications, and databases. A security flaw allows an authorized user to execute malicious commands on the underlying system by providing specially crafted input in the health check settings. This could lead to a full takeover of the application containers and the data they manage.
Technical details
An OS command injection vulnerability exists in Coolify's health check configuration handling within `app/Jobs/ApplicationDeploymentJob.php`. The `generate_healthcheck_commands()` function directly interpolates user-controlled parameters—specifically `health_check_host`, `health_check_method`, and `health_check_path`—into shell commands without proper sanitization or the use of `escapeshellarg()`. An authenticated attacker with permissions to edit application settings can inject shell metacharacters (e.g., `;`, `|`, or `$()`) to achieve remote code execution (RCE) inside deployment containers. This can be exploited via the Web UI or the PATCH API endpoint for applications. The issue is resolved in version 4.0.0-beta.469.
Affected products
- coollabsio Coolify < 4.0.0-beta.469
Timeline
- 2026-03-20: patched: Version 4.0.0-beta.469 released
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-09: disclosed: CVE published to NVD