What is the CVSS score of CVE-2025-64419?

CVE-2025-64419 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Docker are affected by CVE-2025-64419?

Organizations using Coolify face critical risk from CVE-2025-64419, a command injection vulnerability rated CVSS 9.6.. A patch is available.

Is there a public PoC exploit available for CVE-2025-64419?

Yes, a public proof-of-concept exploit is available for CVE-2025-64419. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-64419?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Docker CVE-2025-64419

CRITICAL

Command Injection (CWE-77)

2026-01-05 security-advisories@github.com

Docker Coolify

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 12, 2026 - 14:38 vuln.today

Public exploit code

Patch released

Jan 12, 2026 - 14:38 nvd

Patch available

CVE Published

Jan 05, 2026 - 20:16 nvd

CRITICAL 9.6

DescriptionGitHub Advisory

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.

AnalysisAI

Coolify before 4.0.0-beta.445 allows command injection through docker-compose.yaml parameters. If a victim creates an application from an attacker-controlled repository using the Docker Compose build pack, the attacker achieves root code execution on the Coolify instance. PoC available, patch available.

Technical ContextAI

When Coolify processes a docker-compose.yaml from a user-specified Git repository, parameters from the compose file are interpolated into shell commands without sanitization (CWE-77). An attacker who controls the repository can craft a docker-compose.yaml that injects commands executing as root on the Coolify server.

RemediationAI

Update to 4.0.0-beta.445 or later. Never import docker-compose files from untrusted repositories. Review existing projects for suspicious compose configurations.

More in Docker

View all

CVE-2024-55964 CRITICAL Emergency POC

9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl

CVE-2019-5736 HIGH Act Now POC

8.6 Feb 11

runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac

CVE-2023-32077 HIGH Act Now POC

7.5 Aug 24

Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a

CVE-2026-39987 CRITICAL Act Now POC

9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/

CVE-2023-5815 HIGH Act Now POC

8.1 Nov 22

The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post

CVE-2014-9357 CRITICAL Act Now

10.0 Dec 16

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build

CVE-2026-34156 CRITICAL Act Now POC

9.9 Mar 30

Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l

CVE-2019-15752 HIGH Act Now POC

7.8 Aug 28

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c

CVE-2025-34221 CRITICAL Act Now POC

10.0 Sep 29

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2

CVE-2024-23054 CRITICAL Act Now POC

9.8 Feb 05

An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du

CVE-2025-23211 CRITICAL Act Now POC

9.9 Jan 28

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve

CVE-2026-46339 CRITICAL Act Now POC

10.0 May 19

Unauthenticated remote code execution in 9router (npm package) versions 0.4.30 through 0.4.36 allows network-adjacent at

Same weakness CWE-77 – Command Injection

View all

CVE-2024-21887 CRITICAL POC

9.1

CVE-2012-1823 CRITICAL POC

9.8

CVE-2016-1555 CRITICAL POC

9.8

CVE-2015-2051 HIGH POC

8.8

CVE-2017-6327 HIGH POC

8.8

CVE-2023-34960 CRITICAL POC

9.8

CVE-2023-37679 CRITICAL POC

9.8

CVE-2025-10035 CRITICAL POC

10.0

CVE-2025-64419 vulnerability details – vuln.today

Back

Docker CVE-2025-64419

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Docker

Same weakness CWE-77 – Command Injection

Share

External POC / Exploit Code