CVE-2026-12815: coollabsio coolify Image Name os command injection

Published Jun 21, 2026

Updated

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way. The changelog for 4.1.2 mentions "[i]mproved image, branch, proxy, and deployment input validation".

Affected Software

1 affected component

coollabsio Coolify=4.0.0

Event History

Jun 21, 2026

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

DescriptionSeverityWeakness

Jun 22, 2026

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-12815?

CVE-2026-12815 has a severity rating of medium, specifically 6.3 on the CVSS scale.

How do I fix CVE-2026-12815?

To mitigate CVE-2026-12815, ensure that input validation is properly implemented in the Image Name Handler component.

What type of vulnerability is CVE-2026-12815?

CVE-2026-12815 is categorized as an OS command injection vulnerability.

Can CVE-2026-12815 be exploited remotely?

Yes, CVE-2026-12815 can be exploited remotely due to its nature of os command injection.

Which software is affected by CVE-2026-12815?

CVE-2026-12815 affects coollabsio coolify version 4.0.0.