CVE-2026-34153: Coolify 4.0.0-beta.471 Command Injection via File Storage Path Validation

Technical summary

The vulnerability stems from unsafe shell command construction in the LocalFileVolume::saveStorageOnServer function. The fs_path and parent_dir parameters—derived from user-controlled input—are incorporated into shell commands without escaping or sanitization before validation occurs. Additionally, the submitFileStorage function fails to validate the file-mount path before volume creation, creating an entry point for malicious paths. This pre-validation command building allows an authenticated attacker to inject shell metacharacters and execute arbitrary code with the privileges of the Coolify process when storage configuration is saved.

Business impact

An authenticated attacker can achieve remote code execution (RCE) on the underlying server infrastructure, leading to potential data exfiltration, service disruption, or lateral movement within the network. Since Coolify often manages multiple applications and databases, a successful exploit could compromise multiple services and data stores simultaneously. The authentication requirement provides some defense-in-depth, but any user account with file storage permissions becomes a potential attack vector—including lower-privilege employees or compromised accounts.

Affected systems

Coolify versions prior to 4.0.0-beta.471 are affected. This includes all stable and beta releases up to 4.0.0-beta.470. The vulnerability affects self-hosted Coolify installations regardless of deployment environment (Docker, VPS, bare metal) or operating system, as long as the affected version is running.

Exploitability

Exploitability is relatively straightforward for an attacker with valid Coolify credentials. The attack requires only standard web UI or API access to the file storage configuration feature—no special tools or complex techniques are needed. An attacker can craft a malicious path (e.g., containing shell operators like semicolons or command substitution) and trigger code execution when the storage configuration is saved. The attack surface is limited to authenticated users, which reduces immediate exposure but remains a significant risk in shared-access or compromised-credential scenarios.

Remediation

Update Coolify to version 4.0.0-beta.471 or later immediately. This version includes fixes to properly escape and validate fs_path and parent_dir values before shell command construction, and adds validation to the submitFileStorage function. For organizations unable to upgrade immediately, restrict file storage configuration permissions to trusted administrators only, and monitor for suspicious file storage additions via audit logs.

Patch guidance

Upgrade to Coolify 4.0.0-beta.471 or any subsequent stable release. If you are running a production instance, verify the exact version available in your deployment channel (official releases, Docker registry, or your package manager). Apply the update during a maintenance window and restart the Coolify service. Validate that existing file storage configurations continue to function after the upgrade.

Detection guidance

Search audit logs and application logs for file storage configuration changes, particularly any entries with unusual characters in path fields (semicolons, backticks, dollar signs, pipes, or other shell metacharacters). Monitor system-level command execution logs for unexpected child processes spawned by the Coolify service. Use HIDS (Host Intrusion Detection System) or EDR tools to alert on command execution originating from the Coolify process with suspicious arguments.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.8), direct path to unauthenticated remote code execution, and the critical role Coolify plays in infrastructure management. Even though it requires authentication, any user with file storage permissions represents a threat vector, and the blast radius is substantial—a single compromised Coolify instance can cascade to multiple applications and data stores. Organizations running Coolify should treat this as a critical priority for patching.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a network-accessible vulnerability with low attack complexity, low privilege requirements (authenticated access), and high impact across confidentiality, integrity, and availability. The pre-authentication requirement prevents a fully critical rating, but the combination of straightforward exploitability and severe consequences (RCE with Coolify service privileges) justifies the HIGH severity classification.

Frequently asked questions