CVE-2026-34057

HighCVSS 8.8

Published: 07/07/2026(UTC)Updated: 07/07/2026(UTC)Translated: 08/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

27th percentile - higher than 27% of all known CVEs

Summary

Coolify prior to 4.0.0-beta.471 has a vulnerability in the database import Livewire component that allows an authenticated user to inject commands via the database import container name. Lack of locking and validation lets client-controlled container and server properties reach shell commands.

Risk Assessment

An attacker can execute arbitrary commands on the server, leading to full system compromise, data leakage, or service disruption.

Recommendation

Immediately update Coolify to version 4.0.0-beta.471 or later. Restrict access to the database import feature to trusted users only.

Original NVD description (English source)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the database import Livewire component (app/Livewire/Project/Database/Import.php) allows client-controlled container and server properties to reach shell commands without locking or validation, allowing an authenticated user to inject commands through a database import container name. This issue is fixed in version 4.0.0-beta.471.