Coolify is an open‑source and self‑hostable platform for managing servers, applications, and databases. Before version 4.0.0‑beta.474, the API accepted database credential fields such as redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, and mysql_user only as generic strings, performing no shell‑safety checks. These values were then interpolated directly into Docker Compose YAML commands without escaping. This flaw allows an attacker who can write these fields to inject arbitrary shell commands that execute during container startup, potentially compromising the host system. The vulnerability corresponds to CWE‑78, which focuses on unsafe execution of system commands.

The affected product is Coolify from Coollabs.io. All releases prior to version 4.0.0‑beta.474 are vulnerable when creating or updating database services via the API, with the credential fields mentioned above.

The CVSS score of 3.3 indicates a low severity, mainly because the flaw requires manipulating application input rather than an external trigger. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires write‑access to the API that creates or updates database credentials, which may allow local or remote injection depending on the deployment environment. This vulnerability has low exploitation probability but could lead to severe compromise if abused.