What is the CVSS score of CVE-2026-42145?

CVE-2026-42145 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-42145?

Yes, a patch is available for CVE-2026-42145. Update the affected software to the latest version immediately.

Coolify CVE-2026-42145

EUVD-2026-41985 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-07 GitHub_M

PHP File Upload Coolify

3.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint requires only a valid authenticated session; uploading an oversized file involves no meaningful attack complexity beyond authentication.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 04:13 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http/Controllers/UploadController.php) for database backup restore uploads did not enforce file type or size validation, allowing an authenticated user to upload unexpected or oversized files that could affect service availability. This issue is fixed in version 4.0.0-beta.474.

AnalysisAI

Coolify's database backup restore file upload endpoint accepts uploads without enforcing any file type or size constraints, enabling an authenticated user to degrade service availability by uploading oversized or unexpected files. All releases prior to 4.0.0-beta.474 are affected per CPE cpe:2.3:a:coollabsio:coolify. No public exploit code exists and the vulnerability is not listed in CISA KEV; with a CVSS score of 3.1 and availability-only impact, this represents a low-priority issue for most operators, especially given the authenticated access requirement.

Technical ContextAI

Coolify is a PHP-based, self-hostable DevOps management platform that allows users to manage servers, applications, and databases through a web interface. The vulnerable component is app/Http/Controllers/UploadController.php, the Laravel controller handling file uploads specifically for the database backup restore feature. CWE-434 (Unrestricted Upload of File with Dangerous Type) describes the root cause: the endpoint performs no server-side MIME type validation and imposes no file size limit before persisting the upload. This means any file - regardless of type or size - is accepted, creating a path to disk exhaustion or potential processing of malformed data by the restore pipeline. The CPE cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:* confirms all Coolify versions prior to the fix are affected.

RemediationAI

Upgrade to Coolify version 4.0.0-beta.474 or later, available at https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474. The fix was implemented via pull request #9667 (https://github.com/coollabsio/coolify/pull/9667) and committed in e6a6446daeace2999fb77888a611a3271812911f, which introduces file type and size validation to UploadController.php. If an immediate upgrade is not feasible, operators should restrict access to the backup restore upload endpoint at the network or reverse-proxy layer, limiting it to trusted internal IP ranges only - this trades some operational convenience for a meaningful reduction in exposure surface. Additionally, enforcing OS-level disk quotas on the Coolify host can cap the blast radius of any oversized upload, though it does not address the underlying validation gap.