Coolify CVE-2025-66212

Requires an authenticated Coolify user who holds application/service management permissions (PR:L) - read-only users and fully unauthenticated attackers cannot exploit it directly. The specific prerequisite is reaching the Dynamic Proxy Configuration Filename handling code path and supplying a filename containing shell metacharacters, which is then passed into a shell command without escaping. No user interaction or non-default configuration is needed once such an account exists; all versions prior to 4.0.0-beta.451 (including the 4.0.0-beta100 through beta108 builds and earlier) are affected. The practical limiting factor is the trust model: the risk is concentrated in multi-user or shared Coolify deployments where lower-privilege operators are granted service-management roles, or where such an account is phished/compromised.

Signals are moderately consistent but point to a conditional rather than mass-exploitable threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with full vulnerable- and subsequent-system impact (VC/VI/VA/SC/SI/SA all High) yields 9.4, reflecting that a successful attacker gains root RCE on managed servers - a severe technical impact. However, PR:L is the critical limiter: this is an authenticated flaw requiring an account that already holds application/service management permissions, so it is a privilege-escalation/post-authentication path, not a drive-by remote takeover. EPSS is low at 0.20% (41st percentile) and the CVE is NOT in CISA KEV, indicating no evidence of widespread active exploitation despite the high CVSS. Publicly available exploit code exists (the 0xrakan repository), which raises operational risk for internet-exposed, multi-user Coolify instances, but POC availability is distinct from active exploitation. Net: a genuine high priority for organizations running shared/multi-tenant Coolify where lower-trust users hold service-management roles, but the authentication precondition and low EPSS argue against treating it as an unauthenticated internet-wide emergency. Note a discrepancy to verify: the description names 'Dynamic Proxy Configuration Filename handling' as the sink, while the provided patch diff shows escaping added to database-name and init-script-filename handling - see confidence notes.

An attacker who has, or has compromised, a Coolify account with application/service management permissions crafts a proxy configuration filename containing shell metacharacters. Because the filename is concatenated into a shell command without escaping, the injected payload executes as root on the managed server. Publicly available exploit code (the 0xrakan GitHub repository covering CVE-2025-66209-66213) lowers the skill barrier, and the low attack complexity (AC:L) means no special timing or conditions are needed once the account exists.