The flaw is a classic OS command injection (CWE-78) in Coolify, an open‑source platform for managing servers, databases, and applications. Persistent volume names are interpolated directly into shell commands executed on managed servers without escaping or validation. An authenticated user who can specify a volume name can insert shell metacharacters, causing the command to execute arbitrary code with root privileges when the volume operation is triggered. This allows a full compromise of the affected managed server.

The affected coollabsio. Any installation running a version older than 4.0.0‑beta.471 is vulnerable, as the fix was introduced in that release. The vulnerability is not listed in the CISA KEV catalog.

The attack vector is via the managed server’s volume‑management interface; the attacker account access and then trigger a volume operation containing malicious input. The CVSS score of 8.8 indicates high severity, while the EPSS of < 1% suggests a low probability of exploitation in the wild. Because the flaw is reachable through normal UI actions and requires only authenticated credentials, environments that allow regular users to perform volume operations remain at significant risk of exploitation.