What is the CVSS score of CVE-2025-66210?

CVE-2025-66210 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Docker are affected by CVE-2025-66210?

Organizations using Coolify face significant risk from CVE-2025-66210, a OS command injection vulnerability rated CVSS 8.8.

Is there a public PoC exploit available for CVE-2025-66210?

Yes, a public proof-of-concept exploit is available for CVE-2025-66210. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-66210?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

Docker CVE-2025-66210

HIGH

OS Command Injection (CWE-78)

2025-12-23 security-advisories@github.com

Command Injection RCE Docker Linux Coolify

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

PoC Detected

Mar 17, 2026 - 17:16 vuln.today

Public exploit code

CVE Published

Dec 23, 2025 - 22:15 nvd

HIGH 8.8

DescriptionGitHub Advisory

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Import functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in import operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

AnalysisAI

A command injection vulnerability in Coolify's Database Import functionality allows authenticated users with application/service management permissions to execute arbitrary system commands as root on managed servers. The vulnerability stems from unsanitized database names being passed directly to shell commands, enabling full remote code execution. A public proof-of-concept exploit is available, and with an EPSS score of 0.41% (61st percentile), this represents a moderate real-world exploitation risk for organizations using vulnerable Coolify versions.

Technical ContextAI

Coolify is an open-source server management platform that handles applications and databases. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a common but critical flaw where user-controlled input is passed to system shell commands without proper sanitization. Based on the CPE data, all Coolify versions prior to 4.0.0-beta.451 are affected, including the entire 4.0.0-beta series from beta100 through beta450. The issue specifically resides in the Database Import functionality where database names are concatenated into shell commands without escaping special characters, allowing attackers to inject additional commands.

RemediationAI

Upgrade Coolify to version 4.0.0-beta.451 or later immediately, as confirmed in the release notes at https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451. Until patching is possible, restrict access to the Database Import functionality to only highly trusted administrators and monitor for suspicious database names containing shell metacharacters. Review user permissions and temporarily revoke application/service management permissions from untrusted users. Given the availability of public exploit code at https://github.com/0xrakan/coolify-cve-2025-66209-66213, patching should be treated as urgent.