Vulnerability · Published Jul 6, 2026 · Assigned by GitHub_M

CVE-2026-34153Coolify LocalFileVolume fs_path command injection enables RCE

High 8.8

In plain English

A high-severity OS command injection in coolify from coollabsio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.8%top 43.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fs_path and parent_dir values before validation, and submitFileStorage does not validate the user-controlled file-mount path before creating a volume, allowing an authenticated user who can add file storage to execute commands when the storage is saved. This issue is fixed in version 4.0.0-beta.471.

Affected products (as reported)

Vendor	Product	Versions
coollabsio	coolify	< 4.0.0-beta.471

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-46hp-7m8g-7622 x_refsource_CONFIRM
https://github.com/coollabsio/coolify/pull/9176 x_refsource_MISC
https://github.com/coollabsio/coolify/commit/3fdce06b654fa3b7b4be59c0faaab6b4546c78de x_refsource_MISC