Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user (member) to execute system commands as root on the Coolify instance. As of time of publication, it is unclear if a patch is available.
Coolify versions up to v4.0.0-beta.434 contain a command injection vulnerability in git source input fields that allows low-privileged users to execute arbitrary system commands as root. This vulnerability poses a critical risk to self-hosted Coolify deployments used for server and application management.
ثغرة حقن الأوامر في Coolify تسمح للمستخدمين ذوي الامتيازات المنخفضة بتنفيذ أوامر نظام عشوائية بصلاحيات جذر من خلال حقول إدخال مصدر Git. تؤثر الثغرة على جميع النسخ حتى v4.0.0-beta.434 ولم يتم تأكيد توفر تصحيح حتى وقت النشر.
Coolify versions up to v4.0.0-beta.434 contain a command injection vulnerability in git source input fields that allows low-privileged users to execute arbitrary system commands as root. This vulnerability poses a critical risk to self-hosted Coolify deployments used for server and application management.
Immediately upgrade Coolify to a patched version beyond v4.0.0-beta.434 when available. Restrict access to Coolify instances to trusted users only, implement network segmentation to limit exposure, disable git-based deployments if not required, and monitor system logs for suspicious command execution patterns. Apply principle of least privilege to user accounts.
قم بترقية Coolify فوراً إلى نسخة مصححة تتجاوز v4.0.0-beta.434 عند توفرها. قيد الوصول إلى مثيلات Coolify للمستخدمين الموثوقين فقط، وطبق تقسيم الشبكة لتقليل التعرض، وعطل النشر المستند إلى git إذا لم يكن مطلوباً، وراقب سجلات النظام للأنماط المريبة. طبق مبدأ الامتيازات الأقل للحسابات.