Vulnerability · Published Dec 23, 2025 · Assigned by GitHub_M
CVE-2025-66209Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup
Critical 10.0
In plain English
A critical-severity OS command injection in coolify from coollabsio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| coollabsio | coolify | < 4.0.0-beta.451 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/coollabsio/coolify/security/advisories/GHSA-vm5p-43qh-7pmq x_refsource_CONFIRM
- https://github.com/coollabsio/coolify/pull/7375 x_refsource_MISC
- https://github.com/0xrakan/coolify-cve-2025-66209-66213 x_refsource_MISC
- https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451 x_refsource_MISC