CVE-2025-64419
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.
Analysis
Coolify before 4.0.0-beta.445 allows command injection through docker-compose.yaml parameters. If a victim creates an application from an attacker-controlled repository using the Docker Compose build pack, the attacker achieves root code execution on the Coolify instance. PoC available, patch available.
Technical Context
When Coolify processes a docker-compose.yaml from a user-specified Git repository, parameters from the compose file are interpolated into shell commands without sanitization (CWE-77). An attacker who controls the repository can craft a docker-compose.yaml that injects commands executing as root on the Coolify server.
Affected Products
Coolify before 4.0.0-beta.445
Remediation
Update to 4.0.0-beta.445 or later. Never import docker-compose files from untrusted repositories. Review existing projects for suspicious compose configurations.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today