Unrated severityOSV Advisory· Published Jul 6, 2026· Updated Jul 7, 2026
Coolify: Command Injection via unsanitized MongoDB collection names in database backup
CVE-2026-34049
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.451 through 4.0.0-beta.470, database backup handling for MongoDB collection names did not fully validate shell metacharacters, allowing a highly privileged attacker who can configure backup inputs to inject commands. This issue is fixed in version 4.0.0-beta.471.
Affected products
2v4.0.0-beta.470, v4.0.0-beta.469, v4.0.0-beta.468, …+ 1 more
- (no CPE)range: v4.0.0-beta.470, v4.0.0-beta.469, v4.0.0-beta.468, …
- (no CPE)range: 4.0.0-beta.451 - 4.0.0-beta.470
Patches
Vulnerability mechanics
References
4- github.com/coollabsio/coolify/commit/b1de75a7c67ce6aee977bd788b41e61837dbe0b9mitrex_refsource_MISC
- github.com/coollabsio/coolify/pull/9168mitrex_refsource_MISC
- github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471mitrex_refsource_MISC
- github.com/coollabsio/coolify/security/advisories/GHSA-4mpw-wcj4-v9ppmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.