Coolify creates PostgreSQL initialization scripts during database startup; the generate_init_scripts() method fails to enforce strict path usage, allowing any authenticated user to specify a filename that resolves outside the intended scripts directory. This path traversal flaw permits writing arbitrary files to the host filesystem. Because the generated scripts are executed as part of database initialization, the attacker can inject and run code with the privileges of the database service, leading to root-level remote code execution. The weakness is classified as CWE‑22, Path Traversal.

All releases of Coolify before version 4.0.0‑beta.474 from CoollabsIO are affected. Administrators of self-hosted deployments using any insecure version should verify that the software has been upgraded to the patched iteration or newer.

The CVSS score of 8.8 and EPSS score of < 1% indicate a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with privileges sufficient to trigger database initialization – typically a developer or admin account – and must supply the malicious filename; based on the description, it is inferred that this could be done via an authenticated web interface or API. Successful exploitation results in arbitrary file write and full root access to the host.