Coolify EUVD-2026-41979

Requires an authenticated Coolify account (PR:L) with the ability to create or configure a PostgreSQL database resource and control an initialization-script filename processed by generate_init_scripts() in StartPostgresql.php. Exploitation depends on triggering PostgreSQL database initialization so the planted file executes. Limiting factors: valid authentication is mandatory (no unauthenticated path), the attacker must reach the Coolify web UI over the network, and the target must run a version prior to 4.0.0-beta.474; no admin user interaction is required.

The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): network-reachable via the Coolify web UI, low attack complexity, and only low-privilege authentication (PR:L) required, with full confidentiality, integrity, and availability impact consistent with host-level code execution. No EPSS score, KEV listing, or SSVC decision data was provided, so real-world exploitation probability cannot be quantified from the input, and the vulnerability is not confirmed actively exploited. The key limiting factor is that exploitation is authenticated - an attacker needs a valid Coolify account able to create/configure a PostgreSQL resource. This is a genuine high priority for internet-exposed multi-tenant or team Coolify instances (where lower-privileged users exist); single-admin self-hosted instances behind authentication face lower practical risk. No conflicting signals were detected in the supplied data.

A low-privileged but authenticated Coolify user creates a new PostgreSQL database and supplies an initialization script whose filename contains path-traversal sequences, causing Coolify to write attacker-controlled content outside the intended init directory. When the database container initializes, the planted script executes, giving the attacker command execution in the database/host context. No public proof-of-concept was provided, but the disclosed fix commit reveals the vulnerable path.