PT-2026-56136

CVE-2026-34168

Published

2026-07-07

Updated

2026-07-08

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471

Description Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. An authenticated user can execute commands on managed servers when a resource is deleted because the LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without shell argument escaping. This allows the injection of shell metacharacters into the storage name.

Recommendations Update to version 4.0.0-beta.471.

Exploitability

Exploit

Fix

Impacts

Researchers

Kodareef5

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers