CVE-2026-42148

Received Received - Intake

Command Injection in Coolify Prior to 4.0.0-beta.474

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: GitHub, Inc.

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the buildHelperImage method in app/Livewire/Settings/Index.php constructs a Docker build command using the dev_helper_version field without shell escaping, allowing an attacker who can set the helper version and trigger the helper image build in a development environment to execute arbitrary commands on the server. This issue is fixed in version 4.0.0-beta.474.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-42148

Affected Vendors & Products

Vendor	Product	Version / Range
coolify	coolify	to 4.0.0-beta.474 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Coolify, an open-source tool for managing servers, applications, and databases. Before version 4.0.0-beta.474, the buildHelperImage method in the file app/Livewire/Settings/Index.php constructs a Docker build command using the dev_helper_version field without properly escaping shell commands. This means that an attacker who can set the helper version and trigger the helper image build in a development environment can execute arbitrary commands on the server.

Impact Analysis

The vulnerability allows an attacker with the ability to set the helper version and trigger the helper image build in a development environment to execute arbitrary commands on the server. This could lead to unauthorized actions such as modifying files, stealing data, or disrupting services on the affected server.

Mitigation Strategies

To mitigate this vulnerability, upgrade Coolify to version 4.0.0-beta.474 or later, where the issue has been fixed.

Avoid allowing untrusted users to set the dev_helper_version field or trigger the helper image build in development environments.

Hi! I’m here to help you understand CVE-2026-42148. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70