VYPR
← All advisories
Low severity3.3OSV Advisory· Published Jul 6, 2026· Updated Jul 7, 2026

CVE-2026-34049

CVE-2026-34049

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.451 through 4.0.0-beta.470, database backup handling for MongoDB collection names did not fully validate shell metacharacters, allowing a highly privileged attacker who can configure backup inputs to inject commands. This issue is fixed in version 4.0.0-beta.471.

Affected products

2
  • Coollabsio/CoolifyOSV2 versions
    v4.0.0-beta.470, v4.0.0-beta.469, v4.0.0-beta.468, …+ 1 more
    • (no CPE)range: v4.0.0-beta.470, v4.0.0-beta.469, v4.0.0-beta.468, …
    • (no CPE)range: 4.0.0-beta.451 - 4.0.0-beta.470

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.