CVE-2026-42145

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http/Controllers/UploadController.php) for database backup restore uploads did not enforce file type or size validation, allowing an authenticated user to upload unexpected or oversized files that could affect service availability. This issue is fixed in version 4.0.0-beta.474.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/coollabsio/coolify/commit/e6a6446daeace2999fb77888a611a3271812911f
https://github.com/coollabsio/coolify/pull/9667
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474
https://github.com/coollabsio/coolify/security/advisories/GHSA-66gv-g2w9-6wxp

Configurations

No configuration.

History

No history.

Information

Published : 2026-07-07 04:17

Updated : 2026-07-09 16:16

NVD link : CVE-2026-42145

Mitre link : CVE-2026-42145

CVE.ORG link : CVE-2026-42145

JSON object : View

Products Affected

No product.

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-42145", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42145", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T14:21:17.298839Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"status": "affected", "version": "< 4.0.0-beta.474"}]}]}], "published": "2026-07-07T04:17:51.353", "references": [{"url": "https://github.com/coollabsio/coolify/commit/e6a6446daeace2999fb77888a611a3271812911f", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/pull/9667", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-66gv-g2w9-6wxp", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-434"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http/Controllers/UploadController.php) for database backup restore uploads did not enforce file type or size validation, allowing an authenticated user to upload unexpected or oversized files that could affect service availability. This issue is fixed in version 4.0.0-beta.474."}], "lastModified": "2026-07-09T16:16:41.330", "sourceIdentifier": "security-advisories@github.com"}