Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker() helper wraps commands in bash -c '{$command}' without escaping single quotes. User-controlled docker_compose_custom_build_command and docker_compose_custom_start_command fields are interpolated directly, allowing a single quote to break out of the bash -c argument and execute commands on the managed server host (outside the intended Docker container context). This vulnerability is fixed in 4.0.0-beta.464.
Severity (CVSS)
| Base score | 6.6 |
|---|---|
| Severity | Medium |
| Version | CVSS 3.1 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L |
| Provided by | CNA |
Weaknesses
- CWE-78 — CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
| Vendor | Product | Versions |
|---|---|---|
| coollabsio | coolify | < 4.0.0-beta.464 |
References
- https://github.com/coollabsio/coolify/security/advisories/GHSA-6h8g-wpxp-cq98 (x_refsource_CONFIRM)
Generated from the official CVE List on 01 Jul 2026 07:05 UTC.