Cyber Posture

CVE-2025-66211

HighPublic PoC

Published: 23 December 2025

Published
23 December 2025
Modified
17 March 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0047 64.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/service management permissions to execute arbitrary commands as root…

more

on managed servers. PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of PostgreSQL init script filenames before passing to shell commands, preventing command injection by blocking malicious payloads.

SI-9 Information Input Restrictions good match
prevent

Restricts PostgreSQL init script filenames to organization-defined safe patterns or conditions, blocking injection attempts through disallowed characters or formats.

SI-2 Flaw Remediation good match
prevent

Remediates the specific command injection flaw by identifying, testing, and installing the patch in Coolify version 4.0.0-beta.451 or later.

Security SummaryAI

CVE-2025-66211 is an authenticated command injection vulnerability (CWE-78) in the PostgreSQL Init Script Filename handling of Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The issue affects versions prior to 4.0.0-beta.451, where PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling attackers to inject and execute arbitrary commands.

Attackers with application or service management permissions can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants full remote code execution as root on the managed servers, resulting in high confidentiality, integrity, and availability impacts, as reflected in the CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Mitigation is available in Coolify version 4.0.0-beta.451, which addresses the vulnerability through a fix detailed in the associated pull request. Official security advisories and release notes on GitHub recommend upgrading to this version or later to prevent exploitation.

Details

CWE(s)
CWE-78

Affected Products

coollabs
coolify
4.0.0 · ≤ 4.0.0

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Authenticated command injection in shell via PostgreSQL init script filenames enables remote exploitation of the service (T1210), Unix shell execution (T1059.004), and privilege escalation to root (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References