Coolify Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Coolify versions prior to v4.0.0-beta.420.7. This issue arises in the project deployment workflow, where authenticated users with low-level member privileges can inject arbitrary shell commands. The vulnerability is exploited by crafting a repository string that includes command injection syntax, which is then executed on the host system, potentially leading to a full server compromise.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the host system, with the potential for full server compromise.

Remediation

Users are advised to update to Coolify version v4.0.0-beta.420.7 or later.