What is the CVSS score of CVE-2026-34057?

CVE-2026-34057 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Coolify are affected by CVE-2026-34057?

Coolify's self-hosted infrastructure platform contains a vulnerability allowing any authenticated user to execute arbitrary code and gain complete control of underlying servers.. A patch is available.

How to fix or mitigate CVE-2026-34057?

24 hours: Audit all Coolify user accounts and restrict database import access to trusted administrators; enable audit logging. 7 days: Test upgrade to version 4.0.0-beta.471 in staging environment; develop patching procedure. 30 days: Deploy stable patch when released; review access logs for suspicious activity; validate all instances are patched.

Coolify CVE-2026-34057

EUVD-2026-41994 HIGH

OS Command Injection (CWE-78)

2026-07-07 GitHub_M

PHP Command Injection Coolify Coollabsio

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable web UI (AV:N), simple metacharacter injection (AC:L), requires a valid low-privileged account (PR:L), no victim interaction (UI:N); host command execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 04:01 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the database import Livewire component (app/Livewire/Project/Database/Import.php) allows client-controlled container and server properties to reach shell commands without locking or validation, allowing an authenticated user to inject commands through a database import container name. This issue is fixed in version 4.0.0-beta.471.

AnalysisAI

OS command injection in Coolify's self-hosted server/app management platform lets an authenticated user achieve remote code execution on the underlying host via a malicious database import container name. The database import Livewire component passes client-controlled container and server properties into shell commands without locking or validation, so any low-privileged authenticated user can inject arbitrary commands. Rated CVSS 8.8 and fixed in 4.0.0-beta.471; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Coolify is an open-source, self-hostable PaaS (a Heroku/Netlify alternative) that provisions and manages servers, applications, and databases, largely by orchestrating Docker containers through shell commands issued from a PHP/Laravel Livewire backend. The flaw is a classic CWE-78 (OS Command Injection): the database import handler in app/Livewire/Project/Database/Import.php interpolates client-supplied container and server properties (notably the container name) directly into a shell command string. Because these Livewire-bound properties are attacker-controllable and are used without locking (server-side re-validation) or input sanitization, shell metacharacters embedded in the container name break out of the intended command and execute on the host running the Coolify worker.

RemediationAI

Vendor-released patch: 4.0.0-beta.471 - upgrade Coolify to 4.0.0-beta.471 or later, which adds server-side locking/validation of the container and server properties before they reach shell commands (fix commit d486bf09ab2da8ad78fa721a079f066c76ce08d2). Until you can upgrade, restrict who holds Coolify accounts and tighten team membership so only fully trusted operators can create or import databases, since the exploit requires an authenticated session; where feasible, avoid exposing the Coolify management UI directly to untrusted networks (place it behind a VPN or IP allowlist) and audit database-import container names for shell metacharacters. These access-restriction workarounds reduce exposure but do not remove the injection, and limiting account provisioning may impede legitimate multi-user workflows, so patching remains the only complete remediation. See the advisory at https://github.com/coollabsio/coolify/security/advisories/GHSA-6r3g-w7x8-54fj.