Command Injection Vulnerability in Coolify by Coollabsio

CVE-2026-34168

What is CVE-2026-34168?

Coolify, an open-source tool for managing servers, applications, and databases, contains a vulnerability that affects the handling of the LocalPersistentVolume.name field. In versions prior to 4.0.0-beta.471, this field is incorporated into docker volume shell commands without proper escaping. This oversight enables authenticated users to inject shell metacharacters, potentially executing unauthorized commands on the managed servers when the resource is deleted. Users are advised to upgrade to version 4.0.0-beta.471, which implements necessary safeguards against this vulnerability.

References