CVE-2026-42148
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in Coolify prior to version 4.0.0-beta.474 allows arbitrary command execution on the server due to missing shell escaping in the buildHelperImage method. An attacker can set the dev_helper_version field and trigger the helper image build in a development environment.
Risk Assessment
The risk for the organization includes full server compromise, potentially leading to data theft, service disruption, or further attacks on the infrastructure.
Recommendation
Immediately update Coolify to version 4.0.0-beta.474 or later, which contains a fix for this vulnerability.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the buildHelperImage method in app/Livewire/Settings/Index.php constructs a Docker build command using the dev_helper_version field without shell escaping, allowing an attacker who can set the helper version and trigger the helper image build in a development environment to execute arbitrary commands on the server. This issue is fixed in version 4.0.0-beta.474.