Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http/Controllers/UploadController.php) for database backup restore uploads did not enforce file type or size validation, allowing an authenticated user to upload unexpected or oversized files that could affect service availability. This issue is fixed in version 4.0.0-beta.474.
Published: 2026-07-07
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The upload endpoint for database backup restores in Coolify does not enforce file type or size validation prior to version 4.0.0‑beta.474, allowing an authenticated user to upload unexpected or oversized files that could affect service availability. The flaw corresponds to CWE‑434 and CWE‑770 weaknesses.

Affected Systems

The vulnerability affects deployments of Coolify earlier than version 4.0.0‑beta.474. Any installation running one of those releases with the backup restore feature enabled is susceptible to the issue.

Risk and Exploitability

The CVSS score of 3.1 places the risk in a low severity range and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires legitimate authentication to the application, and the impact is limited to service disruption rather than data compromise or privilege escalation.

Generated by OpenCVE AI on July 26, 2026 at 19:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Coolify to 4.0.0‑beta.474 or later to enforce file type and size validation on database backup restores.
  • Restrict the restore feature to trusted administrators or privileged users to reduce the attack surface.
  • Monitor system logs for unusual error messages that may indicate attempted exploitation of the upload endpoint.

Generated by OpenCVE AI on July 26, 2026 at 19:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
First Time appeared Coollabsio
Coollabsio coolify
Vendors & Products Coollabsio
Coollabsio coolify

Tue, 07 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Description Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http/Controllers/UploadController.php) for database backup restore uploads did not enforce file type or size validation, allowing an authenticated user to upload unexpected or oversized files that could affect service availability. This issue is fixed in version 4.0.0-beta.474.
Title Coolify: File Upload Without Type or Size Validation in Database Backup Restore
Weaknesses CWE-434
CWE-770
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Coollabsio Coolify
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-09T14:43:05.636Z

Reserved: 2026-04-24T17:15:21.834Z

Link: CVE-2026-42145

cve-icon Vulnrichment

Updated: 2026-07-09T14:21:17.938Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T19:45:03Z

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type

  • CWE-770

    Allocation of Resources Without Limits or Throttling