CVE-2026-27955: Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker() helper wraps commands in bash -c '{$command}' without escaping single quotes. User-controlled dockercomposecustombuildcommand and dockercomposecustomstartcommand fields are interpolated directly, allowing a single quote to break out of the bash -c argument and execute commands on the managed server host (outside the intended Docker container context). This vulnerability is fixed in 4.0.0-beta.464.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coolifyto a version that resolves this vulnerability.Fixed in 4.0.0-beta.464 - Configuration
Modify executeInDocker() so it escapes single quotes when wrapping user-influenced commands in bash -c '{$command}', preventing single-quote breakout from the intended bash -c argument context.
Coolify executeInDocker() helper command wrapping in bash -c '{$command}' = Escapes single quotes in $command (no single-quote breakout into bash -c context)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27955?
CVE-2026-27955 has a medium severity rating of 6.6.
How do I fix CVE-2026-27955?
To fix CVE-2026-27955, update Coolify to version 4.0.0-beta.464 or later.
What type of vulnerability is CVE-2026-27955?
CVE-2026-27955 is an OS Command Injection vulnerability.
What is the impact of CVE-2026-27955?
CVE-2026-27955 allows for command injection via a single-quote breakout in the executeInDocker() function.
Which versions of Coolify are affected by CVE-2026-27955?
CVE-2026-27955 affects Coolify versions prior to 4.0.0-beta.464.