Coolify is an open-source platform in the PostgreSQL initialization script generation routine – specifically the generate_init_scripts() method – fails to restrict file paths, allowing an authenticated user to supply a filename that resolves outside the intended initialization directory. This path traversal flaw permits the attacker to write arbitrary files to the host and, because the script execution occurs during database initialization, enables remote command execution with is classified as CWE-22, Path Traversal, leading to a root-level remote code execution.

All releases of Coolify before 4.0 comes from CoollabsIO. Administrators of self-hosted deployments using any insecure version should verify that the software has been upgraded to the patched iteration or newer.

The CVSS score of 8.8SS score of less than 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with privileges sufficient to trigger database initialization – typically a developer or admin account – and must supply the malicious filename via the web interface or API. Successful exploitation results in arbitrary file write and full root access to the host.