CVE-2026-42200: Coolify PostgreSQL Path Traversal Remote Code Execution Vulnerability

Technical summary

The vulnerability exists in the generate_init_scripts() method within app/Actions/Database/StartPostgresql.php. The PostgreSQL initialization script filename handling does not adequately restrict or validate file paths, enabling path traversal attacks. An authenticated attacker can craft malicious input that bypasses directory constraints, write arbitrary files to the filesystem, and achieve remote code execution during the database initialization process. The issue is classified as a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability.

Business impact

This vulnerability poses a critical operational risk for organizations self-hosting Coolify. A malicious authenticated user—whether an insider, compromised account, or attacker with valid credentials—can execute arbitrary commands with the privileges of the Coolify application. This can lead to complete system compromise, unauthorized data access, data exfiltration, lateral movement to connected infrastructure, and service disruption. Organizations relying on Coolify for production workload management face potential loss of availability and confidentiality.

Affected systems

Coolify versions prior to 4.0.0-beta.474 are affected. The vulnerability requires authentication to exploit, limiting exposure to users with legitimate access to the Coolify platform. Self-hosted instances are directly impacted; cloud-hosted or managed deployments depend on the provider's update status.

Exploitability

Exploitation requires valid authentication credentials within the Coolify platform. The attack vector is network-based with low complexity, meaning an authenticated user can perform the attack without special conditions or user interaction. The impact is severe: full compromise of confidentiality, integrity, and availability. While the authentication requirement reduces the attack surface compared to unauthenticated vulnerabilities, the ease of exploitation once authenticated access is obtained, combined with the severity of impact, makes this a material risk.

Remediation

Upgrade Coolify to version 4.0.0-beta.474 or later. This patch implements proper path validation and restriction in the PostgreSQL initialization script handling. Verify the upgrade is applied across all self-hosted Coolify instances. Organizations should also audit user access to Coolify and enforce least-privilege principles for account permissions.

Patch guidance

Apply the patch to version 4.0.0-beta.474 or any subsequent stable release. Verify the patch in your staging environment before deploying to production. Given the authentication requirement, prioritize patching instances accessible to external users or those with elevated user counts. Document the patch date for compliance and audit purposes.

Detection guidance

Monitor Coolify application logs for unusual PostgreSQL initialization activity, especially attempts to reference paths outside the expected database directory (e.g., paths containing "../" or absolute paths). Network-based detection should flag suspicious file writes originating from the Coolify process. Check for unexpected files created in sensitive directories (e.g., web roots, configuration directories) during database initialization. Endpoint detection and response (EDR) tools should alert on process execution spawned from Coolify database initialization routines.

Why prioritize this

This vulnerability scores 8.8 (HIGH) on CVSS v3.1 due to its broad impact on confidentiality, integrity, and availability combined with network-accessible exploitation. Although authentication is required, the low complexity of exploitation and the critical nature of the affected component (database initialization in infrastructure management software) warrant prompt patching. Organizations managing critical infrastructure through Coolify should treat this as a high priority.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) network attack vector—the vulnerability is exploitable over the network; (2) low attack complexity—no special conditions required; (3) low privilege requirement—only authenticated access needed; (4) high impact on confidentiality, integrity, and availability—arbitrary code execution grants full system compromise. The score does not account for the authentication gate, which in real-world context limits exposure but is factored into the 'PR:L' (requires low privilege) vector component.

Frequently asked questions