The vulnerability lies in Coolify's LocalFileVolume::saveStorageOnServer routine, where shell commands are assembled from the fs_path and parent_dir parameters without any escaping or validation. Because submitFileStorage does not verify the user‑controlled file‑mount path before a volume is created, an authenticated user with permission to add file storage can inject arbitrary commands. Once the storage is saved, the injected commands execute with the privileges of the host, allowing full compromise of confidentiality, integrity, and availability under CWE‑78.

All releases of Coolify before version 4.0.0‑beta.471 contain the vulnerable implementation. The affected product is Coolify, an open‑source self‑hosted management tool, provided by Cool Labs.

The CVSS score of 8.8 classifies this flaw as high severity, while the EPSS score of <1% indicates a low probability of exploitation at the time of analysis. It is not listed in CISA’s KEV catalog. The likely attack vector is local (or network‑based if the application is exposed) and requires an authenticated user with the ability to create new storage. When successfully exploited, the attacker gains full host control.