CVE-2025-34159

Summary

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can gain full root access to the underlying server.

Affected Software

Weaknesses

• CWE-94: CWE-94 Improper Control of Generation of Code ('Code Injection')
• CWE-20: CWE-20 Improper Input Validation

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7
• https://coolify.io/
• https://github.com/Eyodav/CVE-2025-34159

• ←Previous
• Next→