Vulnerability · Published Dec 23, 2025 · Assigned by GitHub_M

CVE-2025-66211Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename

Critical 9.4

In plain English

A critical-severity OS command injection in coolify from coollabsio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)2.9%top 13.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
coollabsio	coolify	< 4.0.0-beta.451

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-24mp-fc9q-c884 x_refsource_CONFIRM
https://github.com/coollabsio/coolify/pull/7375 x_refsource_MISC
https://github.com/0xrakan/coolify-cve-2025-66209-66213 x_refsource_MISC
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451 x_refsource_MISC