Remote Code Execution Vulnerability in Coolify by Coollabs

CVE-2025-59156

What is CVE-2025-59156?

Coolify, an open-source tool for managing servers and applications, is susceptible to a Remote Code Execution vulnerability in its application deployment workflow. This vulnerability allows a low-privileged user to inject arbitrary Docker Compose directives when creating or updating projects. By exploiting this flaw, an attacker can define a malicious service that mounts the host filesystem, enabling them to execute commands at the root level on the host operating system, ultimately compromising container isolation. The issue has been addressed in version 4.0.0-beta.420.7.

References