CVEvulnerability

CVE-2025-64419

8.8 HIGH Published 2026-01-05 Modified 2026-10-07 Official page ↗
Status
Analyzed
Published
2026-01-05
Last modified
2026-10-07
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.6 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-77

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.

Affected configurations

• coollabs coolify (< 4.0.0) • coollabs coolify 4.0.0

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References