Coolify Remote Code Execution Vulnerability in Application Deployment Workflow

A remote code execution vulnerability has been identified in Coolify versions prior to v4.0.0-beta.420.6. This vulnerability arises within the application deployment workflow, where authenticated users with low-level member privileges can inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker could gain full root access to the underlying server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server with root privileges.

Remediation

Users are advised to update to Coolify version v4.0.0-beta.420.7 or later, where this vulnerability has been fixed.