Coolify EUVD-2026-38201

Exploitation requires a valid Coolify account with at least low-level privileges (PR:L per CVSS vector) - the attacker must be able to access the deployment or image configuration interface where Docker image names are submitted. No additional non-default configuration is required; any authenticated user who can define or modify a deployment's image reference is a potential attacker. Limiting factors: requires an authenticated session on the Coolify instance; the management interface is typically not exposed to the public internet in well-configured deployments (though no technical enforcement prevents it); and the vulnerability is version-specific to 4.0.0 (with 4.1.2 patching the input handling). Unauthenticated exploitation is not supported by the available CVSS data (PR:L).

There is a significant discrepancy between the reported CVSS 4.0 score of 2.1 and the realistic severity of this vulnerability. The provided vector's impact metrics (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) appear severely understated for OS command injection in a Docker orchestration platform: if an attacker can inject OS commands through image name handling, real-world impact would likely extend to full host compromise - reading secrets and environment variables, writing arbitrary files, pivoting to managed containers, and disrupting services. These outcomes are inconsistent with 'Low' impact ratings. The AV:N/AC:L/AT:N/PR:L/UI:N base metrics (network-exploitable, low complexity, low privilege, no interaction) correctly capture ease of exploitation, but the impact metrics almost certainly understate consequences in a realistic deployment. The E:P modifier (proof-of-concept exploit exists) and the public GitHub PoC elevate urgency beyond what the raw score suggests. No EPSS data was provided, and the vulnerability is not in the CISA KEV catalog, indicating no confirmed mass exploitation at time of analysis. However, low CVSS score combined with a public PoC and no vendor response to disclosure creates a window for opportunistic attackers targeting self-hosted Coolify instances. The realistic risk is meaningfully higher than the 2.1 score implies.

An authenticated Coolify user with access to deployment configuration navigates to the image name input field and submits a crafted value such as 'ubuntu; id > /tmp/pwned' or a more sophisticated payload embedding a reverse shell command. When Coolify's Image Name Handler processes this input to invoke Docker or a shell subprocess, the injected command executes in the server's operating context. Because a public PoC exists on GitHub, the specific payload mechanics are disclosed, lowering the skill bar required for exploitation.