What is the CVSS score of CVE-2026-34153?

CVE-2026-34153 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Coolify are affected by CVE-2026-34153?

Coolify platform deployments face critical host compromise risk through a low-privilege command injection vulnerability in file storage features, affecting any organization that grants multi-tenant…. A patch is available.

How to fix or mitigate CVE-2026-34153?

Within 24 hours: Immediately restrict file storage configuration permissions to administrative users only and audit all existing file storage mounts for suspicious paths. Within 7 days: Contact Coolify maintainers for patch timeline, review access and audit logs for unauthorized file storage creation attempts since deployment, and document all Coolify instances and versions in use across infrastructure. Within 30 days: Apply vendor patch to Coolify version 4.0.0-beta.471 or later across all instances as soon as available, or migrate critical workloads to alternative PaaS if no patch timeline is established.

Coolify CVE-2026-34153

EUVD-2026-41952 HIGH

OS Command Injection (CWE-78)

2026-07-06 GitHub_M

Command Injection Coolify

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable web UI (AV:N) with a low-privileged authenticated account able to add file storage (PR:L), no interaction, and command injection yielding full host compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 06, 2026 - 23:01 EUVD

Analysis Generated

Jul 06, 2026 - 22:33 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fs_path and parent_dir values before validation, and submitFileStorage does not validate the user-controlled file-mount path before creating a volume, allowing an authenticated user who can add file storage to execute commands when the storage is saved. This issue is fixed in version 4.0.0-beta.471.

AnalysisAI

Authenticated command injection in Coolify (self-hostable PaaS) before 4.0.0-beta.471 lets any user with rights to add file storage execute arbitrary OS commands on the host. The LocalFileVolume::saveStorageOnServer routine assembles shell commands from user-controlled fs_path and parent_dir values without escaping, and submitFileStorage never validates the file-mount path before volume creation, so injected shell metacharacters run when the storage is saved. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; risk stems from the low bar (PR:L) and full-compromise impact.

Technical ContextAI

Coolify is an open-source, self-hosted platform-as-a-service (an alternative to Heroku/Netlify/Vercel) that provisions and manages servers, applications, and databases, typically via a Laravel/PHP web control plane that issues shell commands over SSH to managed hosts. The flaw is a classic CWE-78 OS Command Injection: the file-storage feature (persistent bind-mount volumes) takes a user-supplied mount path and passes fs_path and parent_dir directly into a constructed shell command string before any validation. Per the CPE cpe:2.3:a:coollabsio:coolify:*, all releases prior to 4.0.0-beta.471 are affected. Because the control plane runs privileged operations to create volumes on the target server, injected command fragments execute in that privileged context rather than being confined to the intended file path.

RemediationAI

Vendor-released patch: upgrade Coolify to 4.0.0-beta.471 or later, which adds validation/escaping of the file-mount path before the volume shell command is built (see advisory https://github.com/coollabsio/coolify/security/advisories/GHSA-46hp-7m8g-7622, PR https://github.com/coollabsio/coolify/pull/9176, commit 3fdce06b654fa3b7b4be59c0faaab6b4546c78de). Until the upgrade is applied, restrict who can add file storage by limiting Coolify accounts and team roles to trusted operators only and disabling self-service registration, which reduces the pool of potential attackers at the cost of administrative overhead. Additionally, place the Coolify control-plane UI behind a VPN or IP allowlist so the authenticated attack surface is not broadly network-reachable - this hardens exposure but does not eliminate the flaw for any user who can still reach the file-storage feature, so patching remains the only complete fix.