Vulnerability details
CVE-2025-66210
coollabsio coolify
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import
CVSS 4.0
9.4Critical
Official description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Import functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in import operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| coollabsio | coolify | < 4.0.0-beta.451 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://github.com/coollabsio/coolify/pull/7375 x_refsource_MISC
- https://github.com/0xrakan/coolify-cve-2025-66209-66213 x_refsource_MISC
- https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451 x_refsource_MISC
- https://github.com/coollabsio/coolify/security/advisories/GHSA-q33h-22xm-4cgh x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-12-24
- Last updated
- 2026-03-17
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
2.85%
Probability of exploitation in 30 days
86.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')