CVE-2026-42148
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the buildHelper
CVSS
3.8
Bajo
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Publicado: 6 jul 2026 · Última mod.: 7 jul 2026 · CWE-78
0.1%EPSS · 30 días0.1%
2026-07-072026-07-16
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the buildHelperImage method in app/Livewire/Settings/Index.php constructs a Docker build command using the dev_helper_version field without shell escaping, allowing an attacker who can set the helper version and trigger the helper image build in a development environment to execute arbitrary commands on the server. This issue is fixed in version 4.0.0-beta.474.
- github.comhttps://github.com/coollabsio/coolify/commit/dc9322b11f5f4ab96e56af0df7d4f877e96e5e4c
- github.comhttps://github.com/coollabsio/coolify/pull/9670
- github.comhttps://github.com/coollabsio/coolify/security/advisories/GHSA-x9qh-w4c4-54f9
- github.comhttps://github.com/coollabsio/coolify/security/advisories/GHSA-x9qh-w4c4-54f9
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-341978.8 ALT99.9%
KEV—80Apache ActiveMQ Improper Input Validation Vulnerability2dCVE-2024-121210.0 CRÍ99.9%
KEV—80Progress Kemp LoadMaster OS Command Injection Vulnerability4dCVE-2022-262589.8 CRÍ99.6%
KEV—80D-Link DIR-820L Remote Code Execution Vulnerability8dCVE-2026-422718.8 ALT99.6%
KEV—80BerriAI LiteLLM Command Injection Vulnerability2dCVE-2021-252988.8 ALT99.5%
KEV—80Nagios XI OS Command Injection8dCVE-2021-252978.8 ALT98.9%
KEV—80Nagios XI OS Command Injection8d