CVE-2026-34153 Details
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fs_path and parent_dir values before validation, and submitFileStorage does not validate the user-controlled file-mount path before creating a volume, allowing an authenticated user who can add file storage to execute commands when the storage is saved. This issue is fixed in version 4.0.0-beta.471.
A remote code execution vulnerability exists in Coolify versions prior to 4.0.0-beta.471. The issue arises in the LocalFileVolume model, where the saveStorageOnServer method constructs shell commands using unescaped file system path values. This occurs before the paths are validated, allowing authenticated users to inject malicious commands that are executed on the server. Additionally, the file mount submission process does not validate user-controlled paths before creating a volume, further enabling exploitation.
Users can update to Coolify version 4.0.0-beta.471 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 6, 2026CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coollabsio/coolify/commit/3fdce06b654fa3b7b4be59c0faaab6b4546c78de | [email protected] | Source CodeVendor |
| https://github.com/coollabsio/coolify/pull/9176 | [email protected] | Issue TrackingVendor |
| https://github.com/coollabsio/coolify/security/advisories/GHSA-46hp-7m8g-7622 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Coolify | <= 4.0.0-beta.470 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |