Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
coollabsio/coolify
v4.x @ e7dff30
317
Fixes
28
CVEs
CRITICAL
Peak severity
37.1%
Coverage
Highlights
Auth Bypass: 102 prior fixes. Scrutinize any change in this area.
app/Jobs/ApplicationDeploymentJob.php: most-fixed (13 issues). Treat as high-risk during review.
199 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: User-controlled parameters such as git branches, custom dockerfile locations, build targets, and environment variables are interpolated into system commands like docker builds and nixpacks planners, leading directly to host-level command execution.
Auth Bypass: Critical administrative boundaries were bypassed completely when ServerPolicy methods were hardcoded to return true, bypassing all role, ownership, and team separation rules.
Command Injection: Database credentials, S3 backup destinations, and database names were passed directly to CLI tools (e.g. mongodump, pg_dump) without proper shell-escaping, allowing root shell command execution during scheduled backup runs.