EUVD-2026-41979Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitable over the network via the web UI (AV:N/AC:L), requires a low-privilege authenticated account able to define init scripts (PR:L), and yields host code execution with full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts() method in app/Actions/Database/StartPostgresql.php) filename handling did not sufficiently restrict paths, allowing an authenticated user to write files outside the intended directory and achieve command execution through database initialization. This issue is fixed in version 4.0.0-beta.474.
AnalysisAI
Path traversal leading to remote code execution in Coolify (self-hosted PaaS) before 4.0.0-beta.474 allows an authenticated user to abuse insufficient filename sanitization in the PostgreSQL initialization-script generator (generate_init_scripts() in app/Actions/Database/StartPostgresql.php) to write files outside the intended directory and execute commands during database init. Any user with sufficient privileges to provision a PostgreSQL resource can escalate to code execution on the Coolify host. No public exploit identified at time of analysis, though the fix commit and security advisory publicly disclose the vulnerable code path.
Technical ContextAI
Coolify is a PHP/Laravel-based open-source, self-hostable platform-as-a-service for deploying applications, databases, and servers via Docker on user-owned infrastructure (cpe:2.3:a:coollabsio:coolify). The flaw is a CWE-22 improper limitation of a pathname to a restricted directory ('path traversal'): when Coolify provisions a PostgreSQL database, generate_init_scripts() takes user-supplied initialization-script filenames and writes them without adequately restricting traversal sequences. Because PostgreSQL executes scripts placed in its docker-entrypoint-initdb.d directory at container startup, writing an attacker-controlled file to an unintended path converts a file-write primitive into command/script execution during database initialization.
RemediationAI
Vendor-released patch: 4.0.0-beta.474 - upgrade Coolify to that version or later (https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474), which corrects the filename handling in generate_init_scripts(); this is the primary and recommended fix. If immediate upgrade is not possible, reduce exposure by restricting who can create or configure PostgreSQL database resources - limit accounts to trusted administrators and remove or downgrade low-privilege team members, since exploitation requires an authenticated account able to define init scripts (trade-off: reduces delegation in multi-user teams). Additionally, place the Coolify dashboard behind a VPN or IP allowlist to shrink the network attack surface (trade-off: complicates legitimate remote administration). Review advisory GHSA-mv4c-9x67-rrmv and fix commit 1cf6c7d before validating any custom mitigation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today