PT-2025-52855 · Coolify · Coolify

0Xrakan · Published 2025-12-23 · Updated 2026-01-12 · CVE-2025-66212

Positive Technologies · (AI Summary)

CVSS v4.0

9.4

Critical

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.451

Description Coolify is a self-hostable tool for managing servers, applications, and databases. A command injection issue exists in the Dynamic Proxy Configuration Filename handling. Authenticated users with application/service management permissions can execute arbitrary commands as root on managed servers. The issue occurs because proxy configuration filenames are passed to shell commands without proper escaping, allowing for full remote code execution via the filename parameter.

Recommendations Update to version 4.0.0-beta.451 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-66212

GHSA-Q7RG-2J7P-83GP

Affected Products

Coolify

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66212.json · Exploit
• 🔥 https://github.com/0xrakan/coolify-cve-2025-66209-66213 · Exploit
• https://github.com/coollabsio/coolify/pull/7375 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-66212 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66212 · Vendor Advisory
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451 · Note
• https://github.com/coollabsio/coolify/security/advisories/GHSA-q7rg-2j7p-83gp · Note
• https://t.me/cveNotify/147854 · Telegram Post
• https://t.me/CVEtracker/40536 · Telegram Post
• https://t.me/cveNotify/147383 · Telegram Post
• https://twitter.com/ActiveITSolutns/status/2010711515255439850 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2003654483708907741 · Twitter Post
• https://twitter.com/CVEnew/status/2003700507475640454 · Twitter Post