CVE-2026-34153
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In Coolify prior to version 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fs_path and parent_dir values before validation, and submitFileStorage does not validate the user-controlled file-mount path before creating a volume. This allows an authenticated user who can add file storage to execute commands when the storage is saved.
Risk Assessment
An attacker can execute arbitrary commands on the server, leading to full system compromise, data theft, or takeover of managed applications and databases.
Recommendation
Immediately update Coolify to version 4.0.0-beta.471 or later, which includes a fix that removes the command injection vulnerability.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fs_path and parent_dir values before validation, and submitFileStorage does not validate the user-controlled file-mount path before creating a volume, allowing an authenticated user who can add file storage to execute commands when the storage is saved. This issue is fixed in version 4.0.0-beta.471.