Vulnerability · Published Jan 24, 2025 · Assigned by GitHub_M
CVE-2025-22606Coolify Command Injection Vulnerability in Project Name
High 8.5
In plain English
A high-severity OS command injection in coolify from coollabsio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes unescaped characters, such as single quotes (`'`), it breaks out of the intended command structure, allowing attackers to execute arbitrary commands on the host system. This vulnerability allows attackers to execute arbitrary commands on the host server, which could result in full system compromise; create, modify, or delete sensitive system files; and escalate privileges depending on the permissions of the executed process. Attackers with access to project management features could exploit this flaw to gain unauthorized control over the host environment. Version 4.0.0-beta.359 fixes this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| coollabsio | coolify | < 4.0.0-beta.359 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
References
- https://github.com/coollabsio/coolify/security/advisories/GHSA-ccp8-v65g-m526 x_refsource_CONFIRM