Assaf Alassaf

Coolify is an open-source tool for managing servers, applications, and databases. An authenticated user with database management permissions can execute commands on managed servers because the `DatabaseBackupJob` function interpolates user-controlled database credentials and MongoDB collection exclusion names into backup shell commands without adequate escaping.

The Media module supports oEmbed, which utilizes two discovery mechanisms: `providers.json` and URL discovery. The URL discovery code can be exploited to trick the system into making unauthorized server-side requests to any arbitrary URL. This is a Server-Side Request Forgery (SSRF), a flaw where an attacker can force a server to send requests to an unintended location.