PT-2026-56141 · Coollabsio · Coolify

Publicado 2026-07-07 · Atualizado 2026-07-07 · CVE-2026-42200

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate init scripts() method in app/Actions/Database/StartPostgresql.php) filename handling did not sufficiently restrict paths, allowing an authenticated user to write files outside the intended directory and achieve command execution through database initialization. This issue is fixed in version 4.0.0-beta.474.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-42200

Produtos afetados

Coolify

Referências · 5

• https://github.com/coollabsio/coolify/pull/9681 · Nota
• https://github.com/coollabsio/coolify/commit/1cf6c7d0aef8e0edb800ae43f44ded102397cb13 · Nota
• https://github.com/coollabsio/coolify/security/advisories/GHSA-mv4c-9x67-rrmv · Nota
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-42200 · Nota de Segurança