The vulnerability arises in the database import Livewire component where the container name supplied by a client is passed directly to shell commands without any validation or locking. This flaw allows an authenticated user to inject arbitrary shell commands through the container name field, executing those commands with the privileges of the application process. The result is remote code execution that can compromise the host system, exfiltrate data, or establish persistence.

All installations of Coolify by coollabsio running a version earlier than 4.0.0-beta.471 are affected. Versions from the initial release up to and including 4.0.0-beta. The CVSS score of 8.8 denotes high severity indicating potential for remote code execution coupled with authentication. The EPSS score of < 1% indicates a very low, but non‑zero, probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires the attacker to log into the application and leverage the database import interface to supply a crafted container name that includes malicious shell command syntax.

This vulnerability enables an authenticated user to inject arbitrary shell commands through the database import container name. The attacker must log into Coolify and use the import interface, supplying a container name containing shell metacharacters. When the import component concatenates this name into a system command without sanitization, the command executes with the privileges of the application process, potentially giving the attacker full control over the host. The CVSS score of 8.8 reflects high severity, and the EPSS score of <1% indicates a very low exploitation probability, with no entry in the CISA KEV catalog. Once exploited, the attacker can achieve remote code execution, compromising confidentiality, integrity, and availability of the underlying infrastructure.