CVE-2026-27955 Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`
Attackers can execute arbitrary commands on the host server by injecting single quotes into Docker build or start command fields in Coolify.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27955?
CVE-2026-27955 is a medium-severity command injection vulnerability in coollabsio coolify, published on 30 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker() helper wraps commands in bash -c '{$command}' without escaping single quotes. User-controlled docker_compose_custom_build_command and docker_compose_custom_start_command fields are interpolated directly, allowing a single quote to break out of the bash -c argument and execute commands on the managed server host (outside the intended Docker container context). This vulnerability is fixed in 4.0.0-beta.464.
Weakness: CWE-78
Which versions are affected by CVE-2026-27955?
How do I fix CVE-2026-27955?
No fix has been published for CVE-2026-27955 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-27955 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27955 exists.
Sources
Also known as GHSA-6h8g-wpxp-cq98.