The vulnerability stems from PostgreSQL healthcheck commands that incorporate attacker‑controlled database settings (postgres_user and postgres_db) into shell‑form commands. This permits an authenticated user with permission to set these values to inject arbitrary shell commands that run inside the database container. The result is that the attacker can execute any command within that container. Based on the description, it is inferred that this could potentially compromise database data and the underlying host if container isolation is broken. The flaw is a classic command injection (CWE‑78) and is classified with high severity.

Coollabsio’s Coolify application, prior to version 4.0.0‑beta.474, is impacted. Users running self‑hosted Coolify instances with PostgreSQL healthchecks enabled and with authenticated database settings are within the scope of this vulnerability.

The CVSS score of 8.8 indicates high impact. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. The flaw requires authenticated users able to set the postgres_user and postgres_db values in healthcheck commands. Once the injection succeeds, the attacker can run arbitrary shell commands inside the PostgreSQL container. Based on the description, it is inferred that if the container process runs as root, the attacker would obtain root execution inside the container; otherwise the attacker is limited to the container user's privileges. The exploit does not directly escape the container, but weak or misconfigured container isolation could allow pivoting to other services or the host. The exploitation likelihood remains low due to the limited attack surface, but the impact of a successful exploit is severe.