PT-2025-52853 · Coolify · Coolify

Andrasbacsai · Published 2025-12-23 · Updated 2026-01-12 · CVE-2025-66210

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.451

Description Coolify is a self-hostable tool for managing servers, applications, and databases. An authenticated command injection exists in the Database Import functionality, allowing users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in import operations are passed directly to shell commands without sanitization, enabling remote code execution. The vulnerable component is the database import functionality. The database name is a vulnerable parameter.

Recommendations Update to version 4.0.0-beta.451 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-66210

GHSA-Q33H-22XM-4CGH

Affected Products

Coolify

References · 14

• 🔥 https://github.com/coollabsio/coolify/security/advisories/GHSA-q33h-22xm-4cgh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66210.json · Exploit
• 🔥 https://github.com/0xrakan/coolify-cve-2025-66209-66213 · Exploit
• https://osv.dev/vulnerability/CVE-2025-66210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66210 · Security Note
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451 · Note
• https://github.com/coollabsio/coolify/pull/7375 · Note
• https://twitter.com/0dayPublishing/status/2003585316284760304 · Twitter Post
• https://twitter.com/ActiveITSolutns/status/2010711515255439850 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2003659603557413283 · Twitter Post
• https://t.me/CVEtracker/40534 · Telegram Post
• https://t.me/cveNotify/147381 · Telegram Post
• https://t.me/cveNotify/147852 · Telegram Post
• https://twitter.com/CVEnew/status/2003700510571004020 · Twitter Post