CVE-2026-42145: Coolify File Upload Validation Vulnerability

Technical summary

The vulnerability exists in Coolify's UploadController.php file handling backup restore uploads. The endpoint lacks file type validation (whitelist/extension checks) and file size constraints, violating secure file upload practices. An authenticated attacker can submit arbitrary files or exceed expected size limits, potentially exhausting storage resources, triggering out-of-memory conditions, or introducing malformed data into the restoration pipeline. The CVSS 3.1 score of 3.1 (LOW) reflects the authentication requirement and availability-only impact, with no confidentiality or integrity compromise.

Business impact

Organizations using Coolify for production database and application management face service disruption risks if an insider or external attacker with compromised credentials exploits this flaw. Oversized uploads could consume disk space or memory, causing backup/restore operations to fail or the application to become unresponsive. For teams relying on Coolify for critical infrastructure management, this creates operational risk during disaster recovery scenarios when backup restore functionality is needed most. The attack surface is limited to authenticated users, but compromise of a single service account elevates risk significantly.

Affected systems

Coolify versions prior to 4.0.0-beta.474 are affected. No other products or vendors are listed as vulnerable. Self-hosted Coolify deployments of any size are in scope if running an unpatched version and if network or internal access to the application is available to authenticated users.

Exploitability

Exploitation requires valid authentication credentials and direct access to the file upload endpoint. The attacker cannot trigger the vulnerability anonymously. However, in environments where service accounts are shared, credentials are logged in accessible places, or multi-tenant deployments exist, this barrier is substantially lower. The attack itself is trivial—uploading a file requires no special tools or bypass techniques—making it a low-complexity, low-skill exploit once access is obtained. Real-world likelihood depends heavily on credential hygiene and access controls within the deployment.

Remediation

Upgrade Coolify to version 4.0.0-beta.474 or later. This release introduces file type and size validation on the upload endpoint, preventing oversized and unexpected files from being accepted. Administrators should also review access control policies for the backup restore function, restrict upload endpoint access to authorized personnel only, and monitor upload activity for anomalies. Consider implementing network-level upload size limits as a defense-in-depth measure.

Patch guidance

Verify the exact patch version available for your Coolify installation by consulting the official Coolify release notes and advisory. The fix is confirmed in version 4.0.0-beta.474 and any subsequent releases. Test the upgrade in a staging environment before deploying to production, as backup/restore functionality is critical. No rollback guidance is documented; ensure you have working backups before upgrading.

Detection guidance

Monitor upload endpoint logs (app/Http/Controllers/UploadController.php or equivalent web server access logs) for unusual file sizes or types being submitted. Alert on uploads exceeding expected database backup sizes for your environment. Correlate uploads with disk space usage spikes or out-of-memory events. If using a web application firewall (WAF), implement rules to restrict upload Content-Type headers and payloads to expected formats (e.g., tar, gzip, SQL). Track failed restore operations that may indicate malformed uploads.

Why prioritize this

This vulnerability merits prompt but non-emergency attention. The LOW CVSS score and authentication requirement limit immediate enterprise risk, but the attack simplicity and potential for denial of service during critical recovery operations justify timely patching. Organizations running Coolify in production environments should schedule an upgrade within their standard patch cycle. Those managing sensitive infrastructure or with weak credential controls should accelerate the timeline.

Risk score, explained

CVSS 3.1 score of 3.1 reflects: (1) network-accessible attack vector, (2) high attack complexity due to authentication requirement, (3) low privilege needed once authenticated, (4) no user interaction required, (5) availability impact only (denial of service), and (6) no confidentiality or integrity compromise. The score appropriately penalizes the authentication gate while recognizing the operational disruption potential. In-context risk may be higher or lower depending on deployment scale, credential management, and reliance on backup/restore operations.

Frequently asked questions