Command Injection Vulnerability in Coolify by Cool Labs
CVE-2025-64424

9.4CRITICAL

Key Information:

Vendor

Coollabsio

Status
Coolify
Vendor
CVE Published:
5 January 2026

What is CVE-2025-64424?

A command injection vulnerability has been identified in Coolify, an open-source platform designed for managing servers, applications, and databases. This flaw exists in the git source input fields, enabling a low-privileged user to execute arbitrary system commands with root privileges on the affected Coolify instance. At this time, there is no confirmed patch available to address this security risk.

Affected Version(s)

coolify <= 4.0.0-beta.434

References

https://github.com/coollabsio/coolify/security/advisories...
x_refsource_CONFIRM
https://drive.google.com/file/d/1rk7AYxNDkJUwo8uWbzX62PpB...
x_refsource_MISC

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.