Logo
Retour à la veille

CVE-2026-42145

Publié : 7 juillet 2026
Modifié : 7 juillet 2026
Lien officiel NVD
Score CVSS
3.1
LOW

Description détaillée

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http/Controllers/UploadController.php) for database backup restore uploads did not enforce file type or size validation, allowing an authenticated user to upload unexpected or oversized files that could affect service availability. This issue is fixed in version 4.0.0-beta.474.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Références et Patchs

https://github.com/coollabsio/coolify/commit/e6a6446daeace2999fb77888a611a3271812911fhttps://github.com/coollabsio/coolify/pull/9667https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474https://github.com/coollabsio/coolify/security/advisories/GHSA-66gv-g2w9-6wxp

Dernières Vulnérabilités

CVE-2026-58315

Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged into Web Config, unintended operations may be performed.

VOIR DÉTAILS

CVE-2026-57871

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: through 1.0.0-alpha3.

VOIR DÉTAILS

CVE-2026-57870

Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3.

VOIR DÉTAILS