Command Execution Vulnerability in Coolify by Coollabs

CVE-2025-22605

Summary

Coolify, an open-source self-hostable management tool, is susceptible to a command execution flaw that permits authenticated users to execute arbitrary code within the local Coolify container. This vulnerability, present in versions prior to 4.0.0-beta.253, enables attackers to access sensitive data, including private keys and tokens, compromising data integrity across affected instances. Particularly vulnerable are centrally hosted Coolify setups with multiple user registrations, where any malicious user may exploit this issue to leak or manipulate the data and functionality of the platform.

References