CVE-2026-12815 is an operating‑system command injection flaw located in the Image Name Handler of coollabsio coolify 4.0.0. By sending a specially crafted image name value, a remote attacker can cause the application to execute arbitrary shell commands, potentially compromising confidentiality, integrity, and availability of the underlying system. The weakness is categorized as CWE-77 and CWE-78.

The affected product is coollabsio coolify 4.0.0. Version 4.1.2, announced in the changelog, adds improved validation for image, branch, proxy, and deployment inputs, which mitigates the vulnerability. All prior releases, including 4.0.0, remain vulnerable.

The CVSS score of 5.3 places this vulnerability in the medium severity range. Although the EPSS score is not available, the lack of a listing in the CISA KEV catalog suggests the exploitation likelihood is not currently documented. Based on the description, it is inferred that the attack is remote and requires the attacker to send a crafted image name to an exposed endpoint; no local privilege or pre‑existing access is necessary. Consequently, an attacker who can interact with the application can gain complete control over the host system through command execution.