by Kastro
Paper/Archive/CVE-2025-66210

CVE-2025-66210

coollabsio coolify — Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import

EPSS 3%public exploitCVSS 9.4
critical.is priorityof 100
56
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 86.7.867 × 2017.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Import functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in import operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Affected

ProductAffectedFixed inSource
coolify< 4.0.0-beta.451–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/coollabsio/coolify/security/advisories/GHSA-q33h-22xm-4cghrefgithub.com/coollabsio/coolify/pull/7375refgithub.com/0xrakan/coolify-cve-2025-66209-66213refgithub.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451