Command Injection Vulnerability in Coolify by Coollabs
CVE-2026-34158

8.8HIGH

Key Information:

Vendor

Coollabsio

Status
Coolify
Vendor
CVE Published:
7 July 2026

What is CVE-2026-34158?

Coolify, an open-source tool designed for server management, has a command injection vulnerability due to improper handling of user-controlled inputs in the executeInDocker() function. This vulnerability occurs when the application wraps commands in single quotes without escaping embedded quotes, allowing attackers to inject malicious commands through parameters such as docker_compose_custom_build_command or docker_compose_custom_start_command. By exploiting this flaw, an attacker can execute arbitrary commands on the server host during deployment, thereby circumventing Docker container restrictions. This issue has been remediated in version 4.0.0-beta.469.

Affected Version(s)

coolify < 4.0.0-beta.469

References

https://github.com/coollabsio/coolify/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.