CVE-2026-42200
Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts() method in app/Actions/Database/StartPostgresql.php) filename handling did not sufficiently restrict paths, allowing an authenticated user to write files outside the intended directory and achieve command execution through database initialization. This issue is fixed in version 4.0.0-beta.474.
| CWE | CWE-22 |
| Vendor | coollabsio |
| Product | coolify |
| Published | Jul 7, 2026 |
| Last Updated | Jul 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for coollabsio coolify
Be the first to know when new high vulnerabilities affecting coollabsio coolify are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
coollabsio / coolify
< 4.0.0-beta.474
References
github.com: https://github.com/coollabsio/coolify/security/advisories/GHSA-mv4c-9x67-rrmv github.com: https://github.com/coollabsio/coolify/pull/9681 github.com: https://github.com/coollabsio/coolify/commit/1cf6c7d0aef8e0edb800ae43f44ded102397cb13 github.com: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474