Cyber Posture

CVE-2025-59156

HighPublic PoC

Published: 05 January 2026

Published
05 January 2026
Modified
12 January 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0064 70.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)*vulnerability exists in Coolify's application deployment workflow. This flaw allows a low-privileged member to inject arbitrary Docker Compose directives…

more

during project creation or updates. By defining a malicious service that mounts the host filesystem, an attacker can achieve root-level command execution on the host OS, completely bypassing container isolation. Version 4.0.0-beta.420.7 contains a patch for the issue.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the RCE vulnerability by requiring timely remediation through patching Coolify to version 4.0.0-beta.420.7 or later.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes inputs to the application deployment workflow to block injection of arbitrary malicious Docker Compose directives.

AC-6 Least Privilege partial match
prevent

Enforces least privilege to restrict low-privileged members from creating or updating projects in ways that could inject host filesystem mounts leading to RCE.

Security SummaryAI

CVE-2025-59156 is a Remote Code Execution (RCE) vulnerability (CVSS 8.8; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) affecting Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The flaw, linked to CWE-78 (OS Command Injection), exists in Coolify's application deployment workflow prior to version 4.0.0-beta.420.7. It enables attackers to inject arbitrary Docker Compose directives during project creation or updates.

A low-privileged member can exploit this vulnerability remotely with low complexity and no user interaction required. By defining a malicious service in the Docker Compose configuration that mounts the host filesystem, the attacker achieves root-level command execution on the host operating system, fully bypassing container isolation and granting complete control over the underlying infrastructure.

The official Coolify security advisory (GHSA-h5xw-7xvp-xrxr) at https://github.com/coollabsio/coolify/security/advisories/GHSA-h5xw-7xvp-xrxr confirms the issue and states that version 4.0.0-beta.420.7 contains a patch. Security practitioners should upgrade to this version or later to mitigate the vulnerability.

Details

CWE(s)
CWE-78

Affected Products

coollabs
coolify
4.0.0 · ≤ 4.0.0

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1611 Escape to Host Privilege Escalation
Adversaries may break out of a container or virtualized environment to gain access to the underlying host.
attack.mitre.org →
Why these techniques?

The OS command injection vulnerability in Coolify's deployment workflow (Docker Compose directives) directly enables remote service exploitation (T1210), privilege escalation from low-priv to root (T1068), Unix shell command execution (T1059.004), and container escape to host via malicious bind mounts (T1611).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References