Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user (member) to execute system commands as root on the Coolify instance. As of time of publication, it is unclear if a patch is available.
References
| Link | Resource |
|---|---|
| https://drive.google.com/file/d/1rk7AYxNDkJUwo8uWbzX62PpBxpDYeyrZ/view?usp=drive_link | Exploit |
| https://github.com/coollabsio/coolify/security/advisories/GHSA-qx24-jhwj-8w6x | Exploit Vendor Advisory |
| https://github.com/coollabsio/coolify/security/advisories/GHSA-qx24-jhwj-8w6x | Exploit Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2026-01-05 21:16
Updated : 2026-01-12 18:37
NVD link : CVE-2025-64424
Mitre link : CVE-2025-64424
CVE.ORG link : CVE-2025-64424
JSON object : View
Products Affected
coollabs
- coolify
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')