CVE-2026-27955

Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`

State: Published
Severity: 6.6 Medium
Published: Jun 30, 2026
Updated: Jun 30, 2026
Reserved: Feb 25, 2026

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker() helper wraps commands in bash -c '{$command}' without escaping single quotes. User-controlled docker_compose_custom_build_command and docker_compose_custom_start_command fields are interpolated directly, allowing a single quote to break out of the bash -c argument and execute commands on the managed server host (outside the intended Docker container context). This vulnerability is fixed in 4.0.0-beta.464.

Scores

CVSS	Score	Vector	Source
3.1	6.6 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
coolifycoollabsio	< 4.0.0-beta.464Affected

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-6h8g-wpxp-cq98

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.