CVE-2026-42200: Coolify Path Traversal Vulnerability

CVE-2026-42200 Overview

CVE-2026-42200 is a path traversal vulnerability [CWE-22] in Coolify, an open-source self-hostable platform for managing servers, applications, and databases. The flaw resides in the generate_init_scripts() method inside app/Actions/Database/StartPostgresql.php. Insufficient filename sanitization allows an authenticated user to write files outside the intended docker-entrypoint-initdb.d directory. Attackers can leverage this arbitrary file write to achieve command execution through PostgreSQL database initialization. The maintainers addressed the issue in Coolify version 4.0.0-beta.474.

Critical Impact
Authenticated attackers can write arbitrary files on the host filesystem and execute commands via crafted PostgreSQL initialization scripts, leading to full compromise of the Coolify-managed environment.

Affected Products

Coolify versions prior to 4.0.0-beta.474
Self-hosted Coolify deployments exposing PostgreSQL database management
Coolify instances allowing authenticated users to create or modify database init scripts

Discovery Timeline

2026-07-07 - CVE-2026-42200 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-42200

Vulnerability Analysis

Coolify allows users to attach initialization scripts to PostgreSQL databases. These scripts are written to the container's docker-entrypoint-initdb.d directory and executed on database startup. The generate_init_scripts() method constructs a shell command using the user-supplied filename without stripping directory components. An authenticated user can supply a filename containing path traversal sequences to redirect the write to an attacker-chosen location on the host. Because the filename is also interpolated into a shell command, shell metacharacters in the input escape the intended tee target and execute additional commands.

Root Cause

The vulnerable code interpolated $filename directly into a shell command executed on the target server:

echo '{$content_base64}' | base64 -d | tee $this->configuration_dir/docker-entrypoint-initdb.d/{$filename} > /dev/null

No call to basename() stripped directory separators, and no escapeshellarg() contained shell metacharacters. A companion validator existed on the old filename during rename operations in app/Livewire/Project/Database/Postgresql/General.php, but the write path itself trusted the current filename value.

Attack Vector

An authenticated Coolify user with permission to manage a PostgreSQL resource submits an init script whose filename contains ../ sequences or shell metacharacters. When Coolify provisions or restarts the database, the generated shell command writes attacker-controlled content to an arbitrary path on the host, or executes injected shell commands under the privileges of the Coolify agent. PostgreSQL then executes the placed script during container initialization, providing a second execution primitive.

php

 foreach ($this->database->init_scripts as $init_script) {
     $filename = data_get($init_script, 'filename');
     $content = data_get($init_script, 'content');
+
+    // Normalise filename without rejecting legacy values so previously created
+    // init scripts keep deploying. basename() strips any directory components
+    // (path traversal) and escapeshellarg() contains every shell metacharacter
+    // in the tee target. Livewire / API validate new filenames up front.
+    $filename = basename((string) $filename);
+
+    $target_path = "$this->configuration_dir/docker-entrypoint-initdb.d/{$filename}";
+    $escaped_target = escapeshellarg($target_path);
     $content_base64 = base64_encode($content);
-    $this->commands[] = "echo '{$content_base64}' | base64 -d | tee $this->configuration_dir/docker-entrypoint-initdb.d/{$filename} > /dev/null";
-    $this->init_scripts[] = "$this->configuration_dir/docker-entrypoint-initdb.d/{$filename}";
+    $this->commands[] = "echo '{$content_base64}' | base64 -d | tee {$escaped_target} > /dev/null";
+    $this->init_scripts[] = $target_path;
 }

Source: GitHub Commit 1cf6c7d

Detection Methods for CVE-2026-42200

Indicators of Compromise

Files written outside docker-entrypoint-initdb.d directories on hosts managed by Coolify
PostgreSQL init script records whose filename field contains ../, absolute paths, or shell metacharacters such as `, $, ;, or |
Unexpected tee or base64 -d invocations spawned by the Coolify agent targeting paths outside the database configuration directory
New cron entries, SSH authorized_keys modifications, or systemd unit files created around the time of PostgreSQL provisioning events

Detection Strategies

Audit the Coolify database for init_scripts entries and flag any filename value that does not match a strict allow-list pattern such as ^[A-Za-z0-9._-]+\.sql$
Inspect shell command history and process telemetry on Coolify-managed hosts for tee writes targeting paths outside /data/coolify or the expected configuration directory
Review Coolify audit logs and PostgreSQL resource change history for user accounts that created or edited init scripts prior to patching

Monitoring Recommendations

Alert on file creation events under sensitive host locations (/etc, /root/.ssh, /etc/cron.d) originating from the Coolify agent process
Monitor PostgreSQL container startup logs for init scripts referencing unexpected commands or outbound network activity
Track authenticated Coolify API calls to endpoints that create or update database init scripts and correlate with subsequent process execution on the host

How to Mitigate CVE-2026-42200

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.474 or later without delay
Enumerate all existing PostgreSQL init scripts and remove any entries with suspicious filenames before restarting affected databases
Rotate secrets, SSH keys, and API tokens on Coolify-managed hosts if unauthorized init scripts are discovered
Restrict Coolify user accounts and review team membership so only trusted operators can manage database resources

Patch Information

The fix is delivered in Coolify 4.0.0-beta.474. Patch commit 1cf6c7d applies basename() to strip path components from user-supplied filenames and wraps the resulting target path with escapeshellarg() before interpolating it into the tee command. New filenames submitted through the Livewire and API layers are additionally validated with validateFilenameSafe(). See the GitHub Security Advisory GHSA-mv4c-9x67-rrmv, the Pull Request #9681, and the Release v4.0.0-beta.474 notes for full details.

Workarounds

Disable the ability for non-administrator accounts to create or modify PostgreSQL resources until the patch is applied
Place Coolify behind an authenticated reverse proxy or VPN to reduce exposure of authenticated endpoints
Manually inspect and sanitize the init_scripts records in the Coolify database, ensuring each filename is a simple basename ending in .sql

bash

# Upgrade Coolify to the patched release
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash -s -- --version v4.0.0-beta.474

# Verify the running version after upgrade
docker inspect coolify --format '{{.Config.Image}}'