PT-2026-1312 · Coolify · Coolify

Published 2026-01-05 · Updated 2026-01-12 · CVE-2025-59156

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.420.7

Description Coolify is a self-hostable tool for managing servers, applications, and databases. A Remote Code Execution (RCE) issue exists in the application deployment workflow. A low-privileged member can inject arbitrary Docker Compose directives during project creation or updates. By defining a malicious service that mounts the host filesystem, an attacker can achieve root-level command execution on the host OS, bypassing container isolation.

Recommendations Update to version 4.0.0-beta.420.7 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-59156

GHSA-H5XW-7XVP-XRXR

Affected Products

Coolify

References · 8

• 🔥 https://github.com/coollabsio/coolify/security/advisories/GHSA-h5xw-7xvp-xrxr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59156.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-59156 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59156 · Security Note
• https://twitter.com/VulmonFeeds/status/2008264174850261489 · Twitter Post
• https://twitter.com/ActiveITSolutns/status/2010711515255439850 · Twitter Post
• https://twitter.com/CVEnew/status/2008236484113953158 · Twitter Post
• https://twitter.com/0dayPublishing/status/2008270001774465329 · Twitter Post