CVE-2026-42143

8.8 Élevée

Publiée le 07/07/2026 à 06:17 · Modifiée le 07/07/2026 à 17:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, user-controlled persistent volume names are interpolated into shell commands executed on managed servers without escaping or validation, allowing an authenticated member to inject shell metacharacters and execute commands as root when volume operations are triggered. This issue appears to be fixed in version 4.0.0-beta.471.

Traduire en français

Produits concernés

coollabsio coolify

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-78

Références

https://github.com/coollabsio/coolify/commit/d2064dd4998694cda2eabd00149f7c4d1e94c699
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471
https://github.com/coollabsio/coolify/security/advisories/GHSA-6pmw-6m96-4v4m
https://github.com/coollabsio/coolify/security/advisories/GHSA-6pmw-6m96-4v4m

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories