PT-2026-56008 · Coolify · Coolify

Themehackers

·

CVE-2026-34038

·

Published

2026-07-06

·

Updated

2026-07-07

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.469
Description An authenticated remote command injection issue exists in the application deployment handling. Users with application write permissions can achieve remote code execution and exfiltrate sensitive environment variables through deployment logs by manipulating fields such as dockerfile location and deployment commands.
Recommendations Update to version 4.0.0-beta.469.

Exploit

Fix

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34038
GHSA-QQRQ-R9H4-X6WP

Affected Products

Coolify