PT-2026-56008 · Coollabsio · Coolify

Themehackers · Publicado 2026-07-06 · Atualizado 2026-07-06 · CVE-2026-34038

NVD

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, an authenticated remote command injection vulnerability in application deployment handling allows users with application write permissions to achieve remote code execution and exfiltrate sensitive environment variables through deployment logs via fields such as dockerfile location and deployment commands. This issue is fixed in version 4.0.0-beta.469.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-34038

Produtos afetados

Coolify

Referências · 5

• https://github.com/coollabsio/coolify/security/advisories/GHSA-qqrq-r9h4-x6wp · Nota
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.469 · Nota
• https://github.com/coollabsio/coolify/commit/23f9156c7306b221101f1ebbe4d3c6b5e2522acd · Nota
• https://github.com/coollabsio/coolify/pull/9007 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-34038 · Nota de Segurança