Vulnerability · Published Aug 27, 2025 · Assigned by VulnCheck

CVE-2025-34159Coolify Docker Compose Directive Injection in Application Deployment Workflow

Critical 9.4

In plain English

A critical-severity code injection in Coolify from coolLabs Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)1.0%top 37.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can gain full root access to the underlying server.

Affected products (as reported)

Vendor	Product	Versions
coolLabs Technologies	Coolify	0 – before 4.0.0-beta.420.7

Weakness: CWE-94, CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7 vendor-advisory, patch
https://coolify.io/ product
https://github.com/Eyodav/CVE-2025-34159 technical-description, exploit