PT-2026-56019 · Coolify · Coolify

B-Hermes

·

CVE-2026-34153

·

Published

2026-07-06

·

Updated

2026-07-07

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471
Description An authenticated user with permissions to add file storage can execute arbitrary commands when storage is saved. This occurs because the LocalFileVolume::saveStorageOnServer function constructs shell commands using unescaped fs path and parent dir values before validation. Additionally, the submitFileStorage function fails to validate the user-controlled file-mount path during volume creation.
Recommendations Update to version 4.0.0-beta.471.

Exploit

Fix

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34153
GHSA-46HP-7M8G-7622

Affected Products

Coolify