CVE-2026-27955
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk13th percentile — higher than 13% of all known CVEs
Summary
Coolify prior to version 4.0.0-beta.464 has a vulnerability in the executeInDocker() helper that wraps commands in bash -c without escaping single quotes. The docker_compose_custom_build_command and docker_compose_custom_start_command fields are interpolated directly, allowing an attacker to break out of the bash -c argument and execute arbitrary commands on the managed server host.
Risk Assessment
An attacker can gain full control over the managed server by executing commands outside the Docker container, leading to complete compromise of the production environment.
Recommendation
Immediately upgrade Coolify to version 4.0.0-beta.464 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker() helper wraps commands in bash -c '{$command}' without escaping single quotes. User-controlled docker_compose_custom_build_command and docker_compose_custom_start_command fields are interpolated directly, allowing a single quote to break out of the bash -c argument and execute commands on the managed server host (outside the intended Docker container context). This vulnerability is fixed in 4.0.0-beta.464.