CVE-2026-34158

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.469

Description The executeInDocker() helper function fails to properly escape embedded single quotes when wrapping user-controlled commands. An attacker with permissions to edit application settings can inject a single quote into the docker compose custom build command or docker compose custom start command variables. This allows the attacker to break out of the quoted context and execute arbitrary commands on the managed server host during deployments, bypassing the intended Docker container isolation.

Recommendations Update to version 4.0.0-beta.469.