What is the CVSS score of CVE-2025-66209?

CVE-2025-66209 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Coolify are affected by CVE-2025-66209?

Organizations using Coolify face critical risk from CVE-2025-66209, a OS command injection vulnerability rated CVSS 9.9.. A patch is available.

Is there a public PoC exploit available for CVE-2025-66209?

Yes, a public proof-of-concept exploit is available for CVE-2025-66209. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-66209?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Coolify CVE-2025-66209

CRITICAL

OS Command Injection (CWE-78)

2025-12-23 security-advisories@github.com

Command Injection RCE Coolify

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

Patch released

Mar 17, 2026 - 20:45 nvd

Patch available

PoC Detected

Mar 17, 2026 - 17:16 vuln.today

Public exploit code

CVE Published

Dec 23, 2025 - 22:15 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

AnalysisAI

A command injection vulnerability in Coolify's Database Backup functionality allows authenticated users with application/service management permissions to execute arbitrary commands as root on managed servers. The vulnerability affects all Coolify versions prior to 4.0.0-beta.451 and has a publicly available proof-of-concept exploit. With a CVSS score of 9.9 and confirmed exploitation code available, this represents a critical risk for organizations using Coolify to manage their infrastructure.

Technical ContextAI

Coolify is an open-source server management platform that handles applications, services, and databases. The vulnerability exists in the database backup functionality where database names are passed directly to shell commands without proper sanitization, a classic example of CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The affected versions span from early beta releases (4.0.0-beta100) through 4.0.0-beta450, as identified in the CPE entries. The root cause is unsafe string concatenation when constructing shell commands for database backup operations, allowing attackers to inject malicious commands through specially crafted database names.

RemediationAI

Upgrade Coolify to version 4.0.0-beta.451 or later immediately, which contains the fix for this vulnerability as documented in pull request https://github.com/coollabsio/coolify/pull/7375. The patched version is available at https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451. Until patching is possible, restrict access to the Coolify interface to only trusted administrators and monitor database backup operations for suspicious activity. Given the severity and availability of exploits, patching should be prioritized as no effective workarounds can fully mitigate the risk of command injection through the backup functionality.