PT-2026-56133

CVE-2026-34058

Published

2026-07-07

Updated

2026-07-07

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471

Description The Livewire component ServerResources exposes public methods startUnmanaged(), stopUnmanaged(), and restartUnmanaged() that accept a container ID parameter directly from the browser without sanitization or escaping. This parameter is interpolated into shell commands executed via SSH on managed servers, allowing authenticated team members to execute arbitrary OS commands on remote servers.

Recommendations Update to version 4.0.0-beta.471.

Exploitability

Exploit

Fix

Impacts

Researchers

Offensiveee

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers