The flaw is a command injection vulnerability in Coolify’s GetLogs Livewire component that allows an authenticated user with a team‑member role— even the lowest privileged member—to inject arbitrary shell commands directly into the $container property. The property is executed in docker log commands without sanitization, so injected commands results in a classic Remote Code Execution scenario with total compromise of the impacted host, violating confidentiality, integrity, and availability, and the weakness is classified as CWE-78.

The affected product is Coolify version 4.0.0‑beta.470 and earlier from coollabsio. All users who belong to a team, including those with the lowest privilege member role, can exploit the flaw. The issue is fixed in release 4.0.0‑beta.471 and later.

The CVSS score of 8.8 indicates high severity, but the requirement for user authentication limits the attacker scope to legitimate team members. The EPSS score of 1% suggests a low but real probability of not yet listed in the CISA KEV catalog. The likely attack path involves logging into Coolify, navigating to the GetLogs component, and using the Livewire wire protocol to modify the $container property, inserting malicious shell syntax that runs as root.