An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, posing a substantial risk to the confidentiality and integrity of the system.

This vulnerability is classified as an OS Command Injection (CWE-78) occurring when the application fails to properly validate user-supplied input before passing it to system-level commands. Authenticated users can exploit this to achieve unauthorized code execution.

With a CVSS score of 8.8, the vulnerability presents a high risk of total system compromise. Successful exploitation could result in the breach of sensitive data, disruption of critical business services, and potential lateral movement within the network.

Immediate Action: Upgrade to Coolify version 4.0.0-beta.466 or newer immediately.

Proactive Monitoring: Review logs for unusual system calls and monitor for unauthorized changes to system configurations or files.

Compensating Controls: Restrict administrative access to the Coolify dashboard using multi-factor authentication and IP allowlisting to mitigate the risk of unauthorized exploitation.

Public Exploit Available: false

Given the critical nature of command injection flaws, immediate patching is necessary to secure the environment. Ensure that all affected Coolify instances are updated to the specified version to neutralize this high-severity threat.