Logo
Retour à la veille

CVE-2026-34152

Publié : 7 juillet 2026
Modifié : 7 juillet 2026
Lien officiel NVD
Score CVSS
8.8
HIGH

Description détaillée

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to inject additional shell statements that execute on the remote server during deployment. This issue is fixed in version 4.0.0-beta.471.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Références et Patchs

https://github.com/coollabsio/coolify/commit/ad95d65aca064f49b38f73f88d61f842737d5463https://github.com/coollabsio/coolify/pull/9173https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471https://github.com/coollabsio/coolify/security/advisories/GHSA-5qp8-9gg7-4c86

Dernières Vulnérabilités

CVE-2026-58315

Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged into Web Config, unintended operations may be performed.

VOIR DÉTAILS

CVE-2026-57871

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: through 1.0.0-alpha3.

VOIR DÉTAILS

CVE-2026-57870

Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3.

VOIR DÉTAILS