CVE-2026-42145
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Coolify prior to version 4.0.0-beta.474, the file upload endpoint for database backup restore did not enforce file type or size validation. This allowed an authenticated user to upload unexpected or oversized files that could affect service availability.
Risk Assessment
The organization is exposed to a DoS (denial of service) attack by uploading a large file that could overload the system or fill disk space. Additionally, the lack of file type validation creates a risk of uploading a malicious file that could be further processed.
Recommendation
Immediately update Coolify to version 4.0.0-beta.474 or later, which includes the fix for file type and size validation.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http/Controllers/UploadController.php) for database backup restore uploads did not enforce file type or size validation, allowing an authenticated user to upload unexpected or oversized files that could affect service availability. This issue is fixed in version 4.0.0-beta.474.