CVE-2025-22606
Published: 24 January 2025
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes unescaped characters, such as single quotes (`'`), it breaks out of the intended command structure, allowing attackers to execute arbitrary commands on the host system. This vulnerability allows attackers to execute arbitrary commands on the host server, which could result in full system compromise; create, modify, or delete sensitive system files; and escalate privileges depending on the permissions of the executed process. Attackers with access to project management features could exploit this flaw to gain unauthorized control over the host environment. Version 4.0.0-beta.359 fixes this issue.
Security Summary
CVE-2025-22606 is a command injection vulnerability (CWE-78) in Coolify, an open-source, self-hostable tool for managing servers, applications, and databases. It affects version 4.0.0-beta.358 and possibly earlier versions. The flaw occurs when creating or updating a "project," where attackers can inject arbitrary shell commands by manipulating the project name with unescaped characters such as single quotes ('), which break out of the intended command structure and enable execution on the host system. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H).
Attackers with local access and low privileges, such as those able to use project management features, can exploit this issue without user interaction. Successful exploitation allows arbitrary command execution on the host server, potentially leading to full system compromise, creation, modification, or deletion of sensitive files, and privilege escalation based on the permissions of the executed process.
The GitHub security advisory (GHSA-ccp8-v65g-m526) confirms that version 4.0.0-beta.359 addresses the issue by fixing the command injection in project name handling. Security practitioners should update to this patched version and review access controls for project management features.
Details
- CWE(s)