Vulnerability · Published Dec 23, 2025 · Assigned by GitHub_M

CVE-2025-66210Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import

Critical 9.4

In plain English

A critical-severity OS command injection in coolify from coollabsio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)2.9%top 13.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Import functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in import operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
coollabsio	coolify	< 4.0.0-beta.451

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-q33h-22xm-4cgh x_refsource_CONFIRM
https://github.com/coollabsio/coolify/pull/7375 x_refsource_MISC
https://github.com/0xrakan/coolify-cve-2025-66209-66213 x_refsource_MISC
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451 x_refsource_MISC