Coolify CVE-2025-66211

Exploitation requires an authenticated Coolify account holding application or service management permissions on an instance that manages at least one PostgreSQL database; the attacker supplies a crafted PostgreSQL initialization-script filename (via save_init_script in the Postgresql General component) - or, per the fix, a crafted database name in backup configuration - containing shell metacharacters that are passed unvalidated into rm/pg_dump/docker shell commands. Limiting factors: it is NOT pre-authentication (PR:L - a valid account with config/management rights is mandatory), so single-admin self-hosted instances are only self-exploitable, whereas multi-user or multi-tenant deployments with lower-trust operators are genuinely exposed. Affects all 4.0.0 beta builds prior to beta.451.

This is a genuinely high-severity issue but not a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 9.4 score reflect network-reachable, low-complexity exploitation that nonetheless requires authentication (PR:L) - specifically a user who already holds application/service management permissions. The impact metrics are maximal (VC/VI/VA:H plus subsequent-system SC/SI/SA:H), consistent with the description's claim of arbitrary command execution as root on managed servers, which crosses from the Coolify application's authority into full control of downstream hosts. Signals are partially conflicting on urgency: a public POC exists (a GitHub exploit repo is referenced), which raises practical risk, yet EPSS is only 0.41% (61st percentile) and the CVE is NOT listed in CISA KEV, indicating no confirmed active exploitation and low modeled probability of widespread attacks. The PR:L requirement is the key moderating factor - this is a privilege-escalation-to-RCE for an already-authenticated, semi-trusted operator rather than a pre-auth internet worm. Net: a real priority for any multi-tenant or shared Coolify deployment where lower-privileged users exist, but lower practical risk for single-admin self-hosted instances. Note the referenced exploit repo is titled for CVE-2025-66209/66213 rather than this exact CVE number - verify POC applicability to the PostgreSQL init-script vector specifically.

An authenticated Coolify user who holds application or service management permissions configures a managed PostgreSQL database and supplies a malicious init-script filename (or database backup name) containing shell metacharacters. Because the filename is interpolated into a shell command without escaping, the injected payload executes as root on the managed server when the init/backup job runs, yielding full remote code execution. A public proof-of-concept referencing this family of Coolify command-injection flaws is available, lowering the barrier to exploitation.