Coolify CVE-2026-34153

Exploitation requires an authenticated Coolify account (PR:L) that has permission to add file storage / create a file-mount volume, and the attacker must be able to reach the Coolify web control plane over the network (AV:N). The concrete trigger is supplying a crafted file-mount path (the fs_path / parent_dir values consumed by submitFileStorage and LocalFileVolume::saveStorageOnServer); the payload fires when the storage is saved, with no user interaction needed. The principal limiting factor is that unauthenticated outsiders cannot exploit it - the attacker needs valid credentials and the file-storage privilege - so single-operator instances and those with tightly controlled team membership are much lower risk than multi-tenant or open-registration deployments.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact - a serious rating for an authenticated flaw. No EPSS score, KEV entry, or SSVC decision data was provided, and no public POC is referenced, so exploitation is currently no public exploit identified at time of analysis; this tempers urgency relative to an actively-exploited bug but does not lower the technical severity. The main gating factor is authentication: an attacker needs a valid Coolify account with permission to add file storage, so multi-tenant or shared Coolify instances face materially higher risk than single-operator deployments. Signals are internally consistent (the PR:L rating matches the description's 'authenticated user' language), so no conflict needs flagging; the chief unknown is the real-world exploitation probability given the absence of EPSS/KEV data.

An attacker who holds (or obtains) a low-privileged Coolify account with permission to add file storage creates a new persistent file volume and supplies a mount path containing shell metacharacters (for example a path with an embedded command substitution or ';' separator). When the storage is saved and saveStorageOnServer builds and runs the unescaped shell command, the injected commands execute on the managed host with the privileges of Coolify's provisioning process. No public POC is referenced, but the low attack complexity (AC:L) and lack of required user interaction make reliable exploitation straightforward once access is obtained.