CVE-2026-12815: coollabsio coolify Image Name os command injection

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-22 · updated 2026-10-25
Weakness: CWE-77

Description

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way. The changelog for 4.1.2 mentions "[i]mproved image, branch, proxy, and deployment input validation".

Affected products

coollabsio coolify: 4.0.0

References

https://github.com/dxz0069/softwareoverflow/blob/main/coolify_docker_image_reference_shell_injection_vulndb.md
https://vuldb.com/cve/CVE-2026-12815
https://vuldb.com/submit/837577
https://vuldb.com/vuln/372609
https://vuldb.com/vuln/372609/cti
https://github.com/dxz0069/softwareoverflow/blob/main/coolify_docker_image_reference_shell_injection_vulndb.md
https://vuldb.com/submit/837577

Get alerted when CVE-2026-12815 or the next vulnerability affects your stack