Coolify CVE-2025-66213

Requires an authenticated Coolify user who holds application or service management permissions (PR:L) - not available to anonymous or read-only users. The attacker must reach the File Storage Directory Mount Path configuration feature and supply a crafted file_storage_directory_source value containing shell metacharacters; Coolify then executes it as root on managed servers. No user interaction by a victim is required (UI:N) and no non-default configuration is needed beyond having at least one managed server and the ability to configure a file-storage mount. The primary limiting factor is the authentication/authorization gate: exploitation is confined to insiders, credential-compromise, or abuse of over-provisioned management roles. Affected: coollabs Coolify versions prior to 4.0.0-beta.451; fixed in 4.0.0-beta.451.

Signals are mixed and should be read together. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with full High impact to both the vulnerable and subsequent systems (VC/VI/VA/SC/SI/SA all H) correctly reflects a severe outcome: authenticated low-privilege users gain root RCE on every managed server, which is why the 9.4 Critical score is justified rather than inflated. Crucially, PR:L means this is NOT unauthenticated - an attacker must already hold application/service management permissions in Coolify, which meaningfully narrows the threat to malicious or compromised authorized users rather than anonymous internet attackers. This tension is reflected in the EPSS score of only 0.20% (41st percentile): despite publicly available exploit code, mass automated exploitation is unlikely because the vulnerability requires valid authenticated access to a management console. The CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation - exploitation status is limited to 'publicly available exploit code exists.' Net assessment: a genuine high priority for any organization running affected Coolify versions (patch promptly), but the authentication gate and low EPSS indicate this is a privilege-escalation / insider-and-post-compromise risk vector rather than a widespread remote-mass-exploitation emergency.

An attacker who holds (or has phished/stolen) Coolify credentials with application or service management permissions configures a File Storage Directory Mount Path, injecting shell metacharacters into the file_storage_directory_source parameter, which Coolify passes unsanitized into a shell command run as root on the managed server. A public proof-of-concept exists (github.com/0xrakan/coolify-cve-2025-66209-66213), and because AC:L/AT:N, the injection succeeds reliably once the attacker has the required management role, yielding full root command execution on the host.