Authenticated Command Injection Vulnerability in Coolify by Coollabs
CVE-2025-66212

9.4CRITICAL

Key Information:

Vendor

Coollabsio

Status
Coolify
Vendor
CVE Published:
23 December 2025

What is CVE-2025-66212?

Coolify, an open-source platform for managing servers, applications, and databases, prior to version 4.0.0-beta.451, experiences an authenticated command injection vulnerability. This flaw permits any user with application or service management permissions to execute arbitrary commands as root on affected servers. The vulnerability arises from the improper handling of proxy configuration filenames, which are relayed to shell commands without adequate escaping measures. This can lead to complete remote code execution, posing significant risks for users and systems utilizing the affected versions of Coolify. The issue has been rectified in version 4.0.0-beta.451.

Affected Version(s)

coolify 0 < 4.0.0-beta.451

References

https://github.com/0xrakan/coolify-cve-2025-66209-66213
https://github.com/coollabsio/coolify/pull/7375
https://github.com/coollabsio/coolify/releases/tag/v4.0.0...

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-66212 : Authenticated Command Injection Vulnerability in Coolify by Coollabs