coollabsio Coolify up to 4.0.0-beta.470 File Storage LocalFileVolume.php saveStorageOnServer fs_path/parent_dir os command injection

Summaryinfo

A vulnerability, which was classified as critical, was found in coollabsio Coolify up to 4.0.0-beta.470. This affects the function saveStorageOnServer of the file LocalFileVolume.php of the component File Storage. The manipulation of the argument fs_path/parent_dir results in os command injection. This vulnerability is known as CVE-2026-34153. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability classified as critical has been found in coollabsio Coolify up to 4.0.0-beta.470. Affected is the function saveStorageOnServer of the file LocalFileVolume.php of the component File Storage. The manipulation of the argument fs_path/parent_dir with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fs_path and parent_dir values before validation, and submitFileStorage does not validate the user-controlled file-mount path before creating a volume, allowing an authenticated user who can add file storage to execute commands when the storage is saved. This issue is fixed in version 4.0.0-beta.471.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-34153 since 03/25/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

By approaching the search of inurl:LocalFileVolume.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 4.0.0-beta.471 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• coollabsio

Name

• Coolify

Version

• 4.0.0-beta.470

Website

• Product: https://github.com/coollabsio/coolify/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion