CyberRota Analysis
AI-GeneratedCoolify versions prior to 4.0.0-beta.469 are vulnerable due to improper handling of user-controlled commands in the executeInDocker() helper, allowing attackers with edit permissions to inject single quotes and execute arbitrary commands on the host server. This vulnerability can lead to a complete compromise of the server's security by escaping Docker container confinement during deployments. Organizations utilizing Coolify for server management should prioritize upgrading to the patched version to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the executeInDocker() helper wraps user-controlled commands in single quotes without escaping embedded single quotes. Attackers who can edit application settings can inject a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command to break out of the quoted context and execute arbitrary commands on the managed server host during deployments, escaping the intended Docker container confinement. This issue is fixed in version 4.0.0-beta.469.