CVE-2026-42200

Published: Jul 7, 2026Modified: Jul 7, 2026Deferred

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts() method in app/Actions/Database/StartPostgresql.php) filename handling did not sufficiently restrict paths, allowing an authenticated user to write files outside the intended directory and achieve command execution through database initialization. This issue is fixed in version 4.0.0-beta.474.

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (5)

https://github.com/coollabsio/coolify/commit/1cf6c7d0aef8e0edb800ae43f44ded102397cb13

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/pull/9681

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/security/advisories/GHSA-mv4c-9x67-rrmv

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/security/advisories/GHSA-mv4c-9x67-rrmv

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.