PT-2026-56138 · Coolify · Coolify

Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-42145

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.474

Description An issue exists in the file upload endpoint app/Http/Controllers/UploadController.php used for database backup restore uploads. The system fails to enforce file type or size validation, which allows an authenticated user to upload oversized or unexpected files, potentially impacting service availability.

Recommendations Update to version 4.0.0-beta.474.

Fix

Allocation of Resources Without Limits

Unrestricted File Upload

Weakness Enumeration

CWE-770

CWE-434

Related Identifiers

CVE-2026-42145

Affected Products

Coolify

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-42145 · Security Note
• https://github.com/coollabsio/coolify/commit/e6a6446daeace2999fb77888a611a3271812911f · Note
• https://github.com/coollabsio/coolify/security/advisories/GHSA-66gv-g2w9-6wxp · Note
• https://github.com/coollabsio/coolify/pull/9667 · Note
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474 · Note
• https://twitter.com/infoflowcloud/status/2074366995575820745 · Twitter Post
• https://twitter.com/CVEnew/status/2074365836630904919 · Twitter Post