The vulnerability arises from insufficient validation of MongoDB collection names when creating database backups, allowing a command injection flaw (CWE‑78). An attacker who can specify or alter the backup input can inject arbitrary shell commands into the backup process, thereby executing commands on the host running Coolify. This gives the attacker potential full control over the affected system if they possess the required privileges.

Affected products are the coollabsio Coolify application versions 4.0.0-beta.451 through 4.0.0-beta.470 inclusive. These versions lacked complete sanitization of collection names during backup operations. Version 4.0.0-beta.471 and later contain the fix that validates shell metacharacters.

The CVSS score of 3.3 indicates a low overall severity, but exploitation requires a user with high‑privilege rights to configure backups or supply a collection name. The EPSS score of less than 1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw permits general command execution, it remains a significant risk for privileged users and should be remediated promptly.