What is the CVSS score of CVE-2026-59734?

CVE-2026-59734 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Coolify are affected by CVE-2026-59734?

Coolify self-hosted PaaS contains an authenticated command injection vulnerability (CVE-2026-59734, CVSS 8.8) in health-check configuration that allows logged-in users to execute arbitrary commands…. A patch is available.

How to fix or mitigate CVE-2026-59734?

Within 24 hours: restrict application health-check configuration permissions to senior DevOps/platform engineers only; disable health checks if not operationally required. Within 7 days: audit all existing health-check parameters across applications and document which users have modified them in the past 90 days. Within 30 days: monitor vendor releases for patched version (currently no vendor-released patch identified; track GHSA-4fhp-xqqp-w7vv for updates) and plan upgrade to Coolify 4.0.0-beta.469 or later once available.

Coolify CVE-2026-59734

EUVD-2026-42657 HIGH

OS Command Injection (CWE-78)

2026-07-09 security-advisories@github.com

PHP Command Injection

8.8

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-facing web app, low-privileged authenticated user who can set health checks (PR:L), no interaction, and shell execution yields full C/I/A within the unchanged deployment scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 09, 2026 - 19:01 EUVD

Analysis Generated

Jul 09, 2026 - 18:41 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDeploymentJob.php generate_healthcheck_commands() function directly interpolated the health_check_host, health_check_method, and health_check_path parameters into shell commands without proper sanitization, allowing authenticated users to execute arbitrary commands inside deployment containers. This issue is fixed in version 4.0.0-beta.469.

AnalysisAI

Authenticated command injection in Coolify (self-hosted PaaS) before 4.0.0-beta.469 allows a logged-in user to run arbitrary shell commands inside deployment containers by supplying malicious health-check parameters. The generate_healthcheck_commands() routine in ApplicationDeploymentJob.php interpolates the health_check_host, health_check_method, and health_check_path values straight into a shell command line, so any user able to configure an application's health check gains OS command execution during deployment. No public exploit identified at time of analysis, but the upstream fix and advisory (GHSA-4fhp-xqqp-w7vv) publicly document the vulnerable code path.

Technical ContextAI

Coolify is a Laravel/PHP open-source, self-hostable Heroku/Netlify-style platform for deploying and managing applications, databases, and servers. The flaw is a classic CWE-78 OS Command Injection: the deployment job builds container health-check commands (e.g. curl/wget invocations) as raw shell strings and concatenates user-controlled fields (host, method, path) without escaping or using an argument array. Because these strings are executed by a shell interpreter inside the deployment/container context, shell metacharacters (;, |, $(), backticks, &&) in any of the three fields break out of the intended command. The relevant symbol is ApplicationDeploymentJob.php::generate_healthcheck_commands(); the fix (commit 0ffcee7, PR #9007) sanitizes/escapes these inputs.

RemediationAI

Vendor-released patch: 4.0.0-beta.469 - upgrade Coolify to v4.0.0-beta.469 or later, which sanitizes the health_check_host, health_check_method, and health_check_path inputs (see release https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.469 and advisory https://github.com/coollabsio/coolify/security/advisories/GHSA-4fhp-xqqp-w7vv). If you cannot upgrade immediately, reduce exposure by restricting who can create or edit applications and their health-check settings to fully trusted administrators only, and audit existing applications for suspicious health-check host/method/path values containing shell metacharacters; the trade-off is loss of self-service deployment for less-trusted users. Avoid configuring custom health checks on untrusted-tenant instances until patched. There is no reliable in-place input filter short of the vendor fix, so upgrading is strongly preferred over workarounds.