Paper/Archive/CVE-2025-66211

CVE-2025-66211

coollabsio coolify — Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename

EPSS 3%public exploit CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 86.7.867 × 2017.3 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Affected

ProductAffectedFixed inSource

coolify< 4.0.0-beta.451–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/coollabsio/coolify/security/advisories/GHSA-24mp-fc9q-c884 refgithub.com/coollabsio/coolify/pull/7375 refgithub.com/0xrakan/coolify-cve-2025-66209-66213 refgithub.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451