What is the CVSS score of CVE-2026-42148?

CVE-2026-42148 has a CVSS 3.1 base score of 3.8 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-42148?

Yes, a patch is available for CVE-2026-42148. Update the affected software to the latest version immediately.

Coolify CVE-2026-42148

EUVD-2026-41953 LOW

OS Command Injection (CWE-78)

2026-07-06 GitHub_M

PHP Docker Command Injection Coolify Coollabsio

3.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.8 LOW

AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

AV:L/AC:H/PR:H/UI:R retained from vendor assessment; impact raised to H/H/H because successful OS command injection yields full server-level compromise regardless of constrained entry conditions.

3.1 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jul 06, 2026 - 23:01 EUVD

Analysis Generated

Jul 06, 2026 - 22:46 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the buildHelperImage method in app/Livewire/Settings/Index.php constructs a Docker build command using the dev_helper_version field without shell escaping, allowing an attacker who can set the helper version and trigger the helper image build in a development environment to execute arbitrary commands on the server. This issue is fixed in version 4.0.0-beta.474.

AnalysisAI

OS command injection in Coolify's settings module allows a highly privileged attacker in a development environment to execute arbitrary shell commands on the host server by injecting metacharacters into the dev_helper_version field, which is passed unsanitized into a Docker build command. All Coolify releases prior to 4.0.0-beta.474 are affected. No public exploit code exists and no CISA KEV listing has been issued; the provided CVSS score of 3.8 (Low) accurately reflects the highly constrained exploitation prerequisites, though the underlying command injection class warrants upgrade regardless.

Technical ContextAI

Coolify is a PHP/Laravel (Livewire) open-source PaaS alternative for self-hosting servers, applications, and databases (CPE: cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*). The vulnerability is in the buildHelperImage method at app/Livewire/Settings/Index.php, which constructs a Docker CLI build command by interpolating the dev_helper_version field directly into a shell string without sanitization, escaping, or parameterization. CWE-78 (Improper Neutralization of Special Elements in an OS Command) describes this root cause: user-supplied data containing shell metacharacters such as semicolons, pipes, or backticks breaks out of the intended Docker argument context and causes the underlying shell to execute injected directives. The Docker daemon then executes the resultant command with the permissions of the Coolify server process. This code path is only reachable in development environment deployments where the helper image build feature is accessible from the settings interface.

RemediationAI

Upgrade Coolify to version 4.0.0-beta.474 or later, which resolves the injection by properly escaping the dev_helper_version field before use in the Docker build command. The fix is available via merged commit dc9322b11f5f4ab96e56af0df7d4f877e96e5e4c and PR #9670 (https://github.com/coollabsio/coolify/pull/9670); the patched release is confirmed at version 4.0.0-beta.474 per the vendor advisory at https://github.com/coollabsio/coolify/security/advisories/GHSA-x9qh-w4c4-54f9. For environments that cannot immediately upgrade, disable or restrict access to the Settings page to only fully trusted administrators, and avoid running Coolify in development mode on shared or semi-trusted infrastructure. Disabling the helper image build feature in development configurations eliminates the vulnerable code path entirely with no impact on production functionality. Note that restricting UI access alone does not eliminate the underlying insecure code - patching is the definitive remediation.