Coolify
CVE-2025-66212
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionGitHub Advisory
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Dynamic Proxy Configuration Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Proxy configuration filenames are passed to shell commands without proper escaping, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
AnalysisAI
An authenticated command injection vulnerability in Coolify's Dynamic Proxy Configuration Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. The vulnerability affects all Coolify versions prior to 4.0.0-beta.451, with a publicly available proof-of-concept exploit and moderate exploitation likelihood (EPSS 20%, percentile 41%). Attackers can achieve full remote code execution with root privileges by injecting shell commands through unescaped proxy configuration filenames.
Technical ContextAI
Coolify is an open-source, self-hostable platform for managing servers, applications, and databases, similar to a simplified PaaS solution. The vulnerability stems from CWE-78 (OS Command Injection), where proxy configuration filenames are passed directly to shell commands without proper input sanitization or escaping. Based on the CPE data, the vulnerability affects Coolify versions from at least 4.0.0-beta100 through 4.0.0-beta450, though the wildcard CPE entry suggests earlier versions may also be vulnerable. The issue occurs specifically in the Dynamic Proxy Configuration component where user-supplied filenames are concatenated into shell commands executed with elevated privileges.
RemediationAI
Upgrade Coolify to version 4.0.0-beta.451 or later immediately, as this version includes the fix for the command injection vulnerability (see patch at https://github.com/coollabsio/coolify/pull/7375). Until patching is possible, restrict access to Coolify's management interface to trusted administrators only, implement network segmentation to limit which servers can be managed, and monitor for suspicious command execution on managed servers. Review the vendor's security advisory at https://github.com/coollabsio/coolify/security/advisories/GHSA-q7rg-2j7p-83gp for additional context and ensure all managed servers are audited for potential compromise given the root-level execution capability.
Share
External POC / Exploit Code
Leaving vuln.today