CVE-2025-64419

CVE-2025-64419 is a command injection vulnerability (CWE-77) in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters sourced from docker-compose.yaml files are not sanitized before being passed to system commands. This flaw has a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating critical severity with network accessibility, low attack complexity, no required privileges, user interaction needed, and high impacts across confidentiality, integrity, and availability.

An attacker can exploit this vulnerability by controlling a Git repository that a victim user pulls into their Coolify instance when creating an application using the "docker compose" build pack. The unsanitized parameters in the malicious docker-compose.yaml enable arbitrary command execution on the Coolify host as the root user, potentially allowing full compromise of the server, data exfiltration, persistence, or further lateral movement.

The Coolify security advisory (GHSA-234r-xrrg-m8f3) and associated fix commit (f86ccfaa9af572a5487da8ea46b0a125a4854cf6) confirm that upgrading to version 4.0.0-beta.445 or later resolves the issue through proper sanitization of docker-compose.yaml parameters. Security practitioners should advise users to update immediately, validate application sources, and review docker-compose configurations for any ongoing risks.