CVE-2025-66212

Summary

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Dynamic Proxy Configuration Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Proxy configuration filenames are passed to shell commands without proper escaping, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Affected Software

Weaknesses

• CWE-78: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: total

Additional References

• https://github.com/coollabsio/coolify/security/advisories/GHSA-q7rg-2j7p-83gp

References

• https://github.com/coollabsio/coolify/security/advisories/GHSA-q7rg-2j7p-83gp
• https://github.com/coollabsio/coolify/pull/7375
• https://github.com/0xrakan/coolify-cve-2025-66209-66213
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451

• ←Previous
• Next→