CyberRota Analysis
AI-GeneratedCoolify versions prior to 4.2.0 are vulnerable due to improper escaping of environment variable key names in Docker commands executed over SSH, allowing authenticated attackers to inject shell metacharacters. This flaw enables the execution of arbitrary commands on the server host, posing a significant risk to system integrity. Organizations using Coolify for Docker management should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.