PT-2026-1335 · Coolify · Coolify

Published 2026-01-05 · Updated 2026-01-12 · CVE-2025-64424

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Coolify versions up to and including v4.0.0-beta.434

Description Coolify is a self-hostable tool for managing servers, applications, and databases. A command injection exists in the git source input fields of a resource, potentially allowing a low-privileged user (member) to execute system commands as root on the Coolify instance. The git source input fields are the point of entry for this issue.

Recommendations Versions prior to v4.0.0-beta.435 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-64424

GHSA-QX24-JHWJ-8W6X

Affected Products

Coolify

References · 11

• 🔥 https://github.com/coollabsio/coolify/security/advisories/GHSA-qx24-jhwj-8w6x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64424.json · Exploit
• 🔥 https://drive.google.com/file/d/1rk7AYxNDkJUwo8uWbzX62PpBxpDYeyrZ/view?usp=drive_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64424 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64424 · Vendor Advisory
• https://twitter.com/CCBalert/status/2008999931076391122 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2008433114083631310 · Twitter Post
• https://t.me/CVEtracker/41427 · Telegram Post
• https://twitter.com/0dayPublishing/status/2008281342069363029 · Twitter Post
• https://twitter.com/ActiveITSolutns/status/2010711515255439850 · Twitter Post
• https://twitter.com/CVEnew/status/2008346562301489539 · Twitter Post