CVE-2026-34158: high-severity vulnerability in coollabsio coolify
Coolify: Command injection via single-quote breakout in Docker Compose custom commands
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.4%
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the executeInDocker() helper wraps user-controlled commands in single quotes without escaping embedded single quotes. Attackers who can edit application settings can inject a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command to break out of the quoted context and execute arbitrary commands on the managed server host during deployments, escaping the intended Docker container confinement. This issue is fixed in version 4.0.0-beta.469.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
coollabsio · coolifyRelated CVEs — coollabsio coolify
In the same product, most dangerous first.
CVE-2025-66209CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database BackupEPSS 3.9%CVE-2025-66213CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount PathEPSS 3.3%CVE-2025-66212CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration FilenameEPSS 3.3%CVE-2025-66211CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script FilenameEPSS 2.9%CVE-2025-66210CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database ImportEPSS 2.9%CVE-2026-34599HIGHCoolify: Authenticated Remote Code Execution in GetLogs Livewire ComponentEPSS 2.8%