Coolify CVE-2025-66210

Attacker must hold an authenticated Coolify account with application/service management permissions on the target instance (PR:L) - anonymous/unauthenticated access does not work. The specific vulnerable path is the Database Import/backup functionality, where a user-controlled database name is passed directly into docker exec dump commands (mongodump/pg_dump/mysqldump/mariadb-dump) without sanitization in versions prior to 4.0.0-beta.451. No user interaction by a second party is required (UI:N) and no non-default configuration is needed - the default backup/import code path is vulnerable. Limiting factors: requires a valid management-capable account (realistic in multi-user, multi-tenant, or credential-compromise scenarios) and an affected version (< 4.0.0-beta.451); patched instances enforce validateShellSafePath and escapeshellarg.

Signals are largely consistent and point to a genuine high-severity issue, but one that is privilege-gated rather than mass-exploitable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a low-complexity, network-reachable attack with high impact to both the vulnerable system and subsequent systems (VC/VI/VA:H, SC/SI/SA:H), reflecting that injected commands run as root on managed servers - hence the 9.4 critical rating. Exploitation status is 'publicly available exploit code exists' (POC referenced, no CISA KEV listing). The tension in the signals is between severity and reach: EPSS is only 0.41% (61st percentile), which is modest and consistent with PR:L - exploitation requires an already-authenticated user holding application/service management permissions, so this is not an unauthenticated internet-wide worm candidate but an insider, compromised-credential, or multi-tenant privilege-escalation-to-RCE scenario. The low EPSS alongside a public POC and no KEV suggests opportunistic/targeted abuse rather than widespread automated exploitation at this time. Net: a real priority for any Coolify instance with multiple or semi-trusted users, because PR:L plus AC:L plus root-level impact makes post-authentication compromise trivial once an account exists.

An authenticated Coolify user who holds application/service management permissions creates or edits a database and supplies a database name containing shell metacharacters (e.g. backticks or $(...)). When a backup/import job runs, the name is interpolated unsanitized into a docker exec dump command, so the injected payload executes as root on the managed server. Public exploit code is referenced for this Coolify command-injection class, lowering the bar for a would-be attacker with a valid low-privilege account.