PT-2026-56132

CVE-2026-34057

Published

2026-07-07

Updated

2026-07-07

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471

Description The database import Livewire component app/Livewire/Project/Database/Import.php allows an authenticated user to inject shell commands. This occurs because client-controlled container and server properties are passed to shell commands without proper locking or validation, specifically through the database import container name.

Recommendations Update to version 4.0.0-beta.471.

Exploitability

Exploit

Fix

Impacts

Researchers

Joshuaalwin

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers