Coolify CVE-2026-12815

Q: What is the CVSS score of CVE-2026-12815?

CVE-2026-12815 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.2%.

EUVD-2026-38201 LOW

OS Command Injection (CWE-78)

2026-06-21 VulDB

GHSA-5qv5-j543-5fwg

Command Injection Coolify Coollabsio

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-exploitable with low-privilege account; OS command injection in a Docker orchestration platform implies scope change and high host-level C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:48 vuln.today

Severity Changed

Jun 22, 2026 - 00:22 NVD

MEDIUM LOW

CVSS changed

Jun 22, 2026 - 00:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way. The changelog for 4.1.2 mentions "[i]mproved image, branch, proxy, and deployment input validation".

AnalysisAI

OS command injection in Coolify 4.0.0's Image Name Handler allows authenticated remote attackers to execute arbitrary operating system commands by manipulating image name inputs. Coolify is a self-hosted PaaS that orchestrates Docker deployments, making server-side command injection in its image handling pipeline particularly high-impact - the platform typically operates with Docker daemon privileges. Publicly available exploit code exists (CVSS 4.0 E:P, corroborated by a GitHub PoC writeup); no public confirmation of active exploitation is present, and no vendor response to the coordinated disclosure was received.

Technical ContextAI

Coolify (CPE: cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*) is an open-source self-hosted deployment platform that manages Docker containers and application pipelines, analogous to a self-hosted Heroku or Vercel. The affected component is the Image Name Handler - the subsystem responsible for processing Docker image references supplied by users during deployment configuration. CWE-78 (Improper Neutralization of Special Elements used in an OS Command, i.e., OS Command Injection) describes the root cause: user-supplied image name strings are interpolated into shell or subprocess calls without adequate sanitization or escaping. Because Coolify interfaces directly with the Docker daemon and underlying host OS to pull images and launch containers, unsanitized input in this pathway can reach shell execution contexts with elevated system access. The fix, referenced in the 4.1.2 changelog, explicitly addresses 'image, branch, proxy, and deployment input validation,' confirming the remediation targets this class of insufficient input handling across multiple deployment input surfaces.

RemediationAI

The primary fix is to upgrade to Coolify 4.1.2 or later, where the changelog confirms 'improved image, branch, proxy, and deployment input validation' was introduced. This represents an upstream fix referenced by changelog evidence rather than a formal vendor security advisory - no APSB-style bulletin was issued. Administrators should apply this upgrade immediately given the existence of public PoC code. As a compensating control for environments that cannot upgrade immediately, restrict user access to deployment and image configuration features to a minimal trusted set of accounts, reducing the pool of potential attackers (noting that this only limits exploitation opportunity, not the underlying vulnerability). Additionally, consider placing the Coolify management interface behind a VPN or IP allowlist, so the network-exploitable attack vector (AV:N) is constrained to trusted networks - this is a meaningful risk reduction but does not eliminate the flaw. Monitor container and host process trees for unexpected child processes spawned from Coolify's deployment worker. References: VulDB advisory at https://vuldb.com/vuln/372609; PoC details at https://github.com/dxz0069/softwareoverflow/blob/main/coolify_docker_image_reference_shell_injection_vulndb.md.