Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDeploymentJob.php generate_healthcheck_commands() function directly interpolated the health_check_host, health_check_method, and health_check_path parameters into shell commands without proper sanitization, allowing authenticated users to execute arbitrary commands inside deployment containers. This issue is fixed in version 4.0.0-beta.469.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| coollabsio | coolify | < 4.0.0-beta.469 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
cybertechajju/CVE-2026-59734-POC ★ 0 · Jul 11, 2026
OS Command Injection in Health Check → Remote Code Execution
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2026-2192 Coolify: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 9, 2026