PT-2026-1335 · Coolify · Coolify

CVE-2025-64424 · Publicado 2026-01-05 · Atualizado 2026-01-12

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Coolify versions up to and including v4.0.0-beta.434

Description Coolify is a self-hostable tool for managing servers, applications, and databases. A command injection exists in the git source input fields of a resource, potentially allowing a low-privileged user (member) to execute system commands as root on the Coolify instance. The git source input fields are the point of entry for this issue.

Recommendations Versions prior to v4.0.0-beta.435 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2025-64424

GHSA-QX24-JHWJ-8W6X

Produtos afetados

Coolify

Referências · 11

• 🔥 https://github.com/coollabsio/coolify/security/advisories/GHSA-qx24-jhwj-8w6x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64424.json · Exploit
• 🔥 https://drive.google.com/file/d/1rk7AYxNDkJUwo8uWbzX62PpBxpDYeyrZ/view?usp=drive_link · Exploit
• https://twitter.com/CCBalert/status/2008999931076391122 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-64424 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2008433114083631310 · Publicação no Twitter
• https://t.me/CVEtracker/41427 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-64424 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2008281342069363029 · Publicação no Twitter
• https://twitter.com/ActiveITSolutns/status/2010711515255439850 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2008346562301489539 · Publicação no Twitter