Vulnerability · Published Aug 27, 2025 · Assigned by VulnCheck
CVE-2025-34161Coolify Git Repository Field Command Injection in Project Deployment Workflow
Critical 9.4
In plain English
A critical-severity OS command injection in Coolify from coolLabs Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, resulting in full server compromise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| coolLabs Technologies | Coolify | 0 – before 4.0.0-beta.420.7 |
Weakness: CWE-78, CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7 vendor-advisory, patch
- https://coolify.io/ product
- https://github.com/Eyodav/CVE-2025-34161 technical-description, exploit