CyberRota Analysis
AI-GeneratedThe buildHelperImage method in Coolify versions prior to 4.0.0-beta.474 is vulnerable due to improper handling of the dev_helper_version field, which can lead to arbitrary command execution on the server in a development environment. This vulnerability poses a low severity risk but should be prioritized by organizations using Coolify for server management, especially those operating in development settings where untrusted input may be present. Users are advised to upgrade to version 4.0.0-beta.474 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the buildHelperImage method in app/Livewire/Settings/Index.php constructs a Docker build command using the dev_helper_version field without shell escaping, allowing an attacker who can set the helper version and trigger the helper image build in a development environment to execute arbitrary commands on the server. This issue is fixed in version 4.0.0-beta.474.