Cyber Posture

CVE-2025-66212

HighPublic PoC

Published: 23 December 2025

Published
23 December 2025
Modified
17 March 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.9th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Dynamic Proxy Configuration Filename handling allows users with application/service management permissions to execute arbitrary commands as…

more

root on managed servers. Proxy configuration filenames are passed to shell commands without proper escaping, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Requires validation and sanitization of proxy configuration filenames before passing to shell commands, directly preventing command injection exploits.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and timely correction of the command injection flaw through patching to version 4.0.0-beta.451.

AC-6 Least Privilege partial match
prevent

Enforces least privilege on Coolify processes to restrict arbitrary command execution to non-root even if injection succeeds.

Security SummaryAI

Coolify, an open-source and self-hostable tool for managing servers, applications, and databases, is affected by CVE-2025-66212, an authenticated command injection vulnerability (CWE-78) in the Dynamic Proxy Configuration Filename handling prior to version 4.0.0-beta.451. The flaw occurs because proxy configuration filenames are passed directly to shell commands without proper escaping, allowing injection of malicious payloads.

Attackers with application or service management permissions can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N), resulting in high impacts to confidentiality, integrity, and availability (CVSS 8.8; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation enables execution of arbitrary commands as root on managed servers, leading to full remote code execution.

Version 4.0.0-beta.451 addresses the vulnerability by fixing the command injection issue. Official mitigation guidance is provided in the Coolify security advisory (GHSA-q7rg-2j7p-83gp), the associated pull request (#7375), and the release notes for v4.0.0-beta.451. Security practitioners should upgrade affected instances immediately.

Details

CWE(s)
CWE-78

Affected Products

coollabs
coolify
4.0.0 · ≤ 4.0.0

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Authenticated command injection (CWE-78) in proxy configuration directly enables Unix Shell execution (T1059.004), exploitation of remote service (T1210), and privilege escalation to root (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References