CVE-2026-27955 Details
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker() helper wraps commands in bash -c '{$command}' without escaping single quotes. User-controlled docker_compose_custom_build_command and docker_compose_custom_start_command fields are interpolated directly, allowing a single quote to break out of the bash -c argument and execute commands on the managed server host (outside the intended Docker container context). This vulnerability is fixed in 4.0.0-beta.464.
A command injection vulnerability has been identified in Coolify versions prior to 4.0.0-beta.464. The issue arises in the 'executeInDocker()' helper function, which wraps commands in a bash -c context without properly escaping single quotes. This flaw allows user-controlled 'docker_compose_custom_build_command' and 'docker_compose_custom_start_command' fields to break out of the bash argument and execute arbitrary commands on the server host, bypassing Docker container isolation. The vulnerability is present in the 'bootstrap/helpers/docker.php' file, specifically in the 'executeInDocker()' function, as well as in the 'app/Jobs/ApplicationDeploymentJob.php' file, where the unescaped custom compose commands are passed to the Docker execution helper.
Users are advised to update to Coolify version 4.0.0-beta.464 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jun 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coollabsio/coolify/security/advisories/GHSA-6h8g-wpxp-cq98 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/coollabsio/coolify/security/advisories/GHSA-6h8g-wpxp-cq98 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Coolify | < 4.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |