CVE-2026-34057: Coolify Database Import Command Injection Vulnerability

Technical summary

CVE-2026-34057 is a command injection vulnerability in the Livewire-based database import component (app/Livewire/Project/Database/Import.php) of Coolify versions prior to 4.0.0-beta.471. The vulnerability stems from insufficient input validation on container and server properties that are subsequently used in shell command construction. An authenticated attacker can inject shell metacharacters and commands through the database import container name field, which are then executed with the privileges of the Coolify application process. The lack of parameterization or escaping of these user-controlled values creates a direct path from HTTP request input to system command execution.

Business impact

Organizations running vulnerable Coolify instances face significant operational and security risk. An authenticated user—whether a legitimate administrator, compromised account, or insider—can achieve arbitrary command execution on the host system. This enables complete system compromise, including data exfiltration, malware deployment, lateral movement to connected infrastructure, and denial of service. For organizations using Coolify to manage production databases and applications, this vulnerability could lead to unauthorized access to sensitive data, application downtime, and breach of downstream systems managed through the compromised Coolify instance.

Affected systems

Coolify versions prior to 4.0.0-beta.471 are affected. The vulnerability is present in the open-source version and any self-hosted deployments running unpatched builds. The database import feature is a core component, so any Coolify instance with database management capabilities is potentially vulnerable if accessed by an authenticated user.

Exploitability

Exploitation requires valid authentication credentials to access the Coolify interface. No network-layer authentication bypass is needed—the attacker must already have a user account. Once authenticated, the attack is trivial to execute: an attacker simply modifies the container name field during a database import operation to include shell metacharacters (such as semicolons, pipes, or command substitution syntax). The CVSS vector reflects this: while access requires prior authentication (PR:L), the attack complexity is low (AC:L), requires no user interaction (UI:N), and delivers high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). In practice, this means any authenticated user—even one with minimal intended privileges—can escalate to system-level access.

Remediation

Upgrade Coolify to version 4.0.0-beta.471 or later immediately. This version contains input validation and sanitization fixes for the database import component. Before upgrading, review access controls to limit who can reach the database import feature; restrict Coolify user accounts to only those who require database management. For environments where upgrading is blocked by other constraints, disable or restrict access to the database import functionality at the network or application level.

Patch guidance

Apply the update to Coolify 4.0.0-beta.471 as soon as your deployment schedule permits. This is a security patch addressing a HIGH-severity vulnerability in an authenticated context, not a routine update. Test the patch in a staging environment first if feasible, but prioritize deployment over extended testing windows. The fix involves proper input validation in the Import.php Livewire component; verify that the patched version includes sanitization of container and server properties before shell execution. If you maintain a fork or custom build of Coolify, backport the validation changes to your version. Document the patch application in your change log for compliance and incident response purposes.

Detection guidance

Monitor Coolify application logs for unusual activity in the database import feature. Look for failed import attempts with suspicious container names containing shell metacharacters (;, |, $(), `, &, etc.). Check system process logs (auditd on Linux, Process Monitor on Windows) for unexpected child processes spawned by the Coolify application process during or after database import operations. Network-level monitoring should detect outbound connections initiated by the Coolify process that deviate from expected database operations. If you have access to Coolify's database or logs, query for import requests with container names containing special characters or command-like syntax. Correlate these findings with timestamps of suspicious system activity on the host.

Why prioritize this

This vulnerability merits immediate attention due to the combination of direct command injection capability, high severity rating (8.8/HIGH), and minimal attack complexity. Although authentication is required, this is a minor barrier in self-hosted environments where legitimate users may be trusted but then compromised, or where account provisioning is loose. The impact—arbitrary code execution with application-level privileges—is catastrophic for infrastructure management tools like Coolify, which typically have broad network access and administrative capabilities. Delay increases the window for exploitation by insiders, compromised accounts, or coordinated attacks.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) combined with low attack complexity (AC:L) and no user interaction required (UI:N). The requirement for prior authentication (PR:L) prevents a maximum score of 9.8, but does not materially reduce the severity for self-hosted Coolify deployments where authentication may be weak or insider risk is present. The attack vector is network-based (AV:N), allowing exploitation from anywhere with network access to the Coolify interface. The score accurately captures the ease of exploitation and magnitude of potential harm.

Frequently asked questions