coollabsio Coolify up to 4.0.0-beta.473 PostgreSQL Initialization StartPostgresql.php generate_init_scripts initialization

Summaryinfo

A vulnerability has been found in coollabsio Coolify up to 4.0.0-beta.473 and classified as critical. This issue affects the function generate_init_scripts of the file app/Actions/Database/StartPostgresql.php of the component PostgreSQL Initialization. The manipulation leads to initialization. This vulnerability is traded as CVE-2026-42200. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in coollabsio Coolify up to 4.0.0-beta.473. This issue affects the function generate_init_scripts of the file app/Actions/Database/StartPostgresql.php of the component PostgreSQL Initialization. The manipulation with an unknown input leads to a initialization vulnerability. Using CWE to declare the problem leads to CWE-665. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts() method in app/Actions/Database/StartPostgresql.php) filename handling did not sufficiently restrict paths, allowing an authenticated user to write files outside the intended directory and achieve command execution through database initialization. This issue is fixed in version 4.0.0-beta.474.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-42200 since 04/25/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

By approaching the search of inurl:app/Actions/Database/StartPostgresql.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 4.0.0-beta.474 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• coollabsio

Name

• Coolify

Version

• 4.0.0-beta.473

Website

• Product: https://github.com/coollabsio/coolify/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion