---
id: CVE-2025-59157
title: >-
  Coolify is an open-source and self-hostable tool for managing servers,
  applications, and databases
summary: >-
  Coolify is an open-source and self-hostable tool for managing servers,
  applications, and databases. Prior to version 4.0.0-beta.420.7, the Git
  Repository field during project creation is vulnerable to command injection.
  User input is not…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: coollabs
product: coolify
affected:
  - coolify < 4.0.0
  - coolify = 4.0.0
patched:
  - coolify 4.0.0
published: '2026-01-05'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T22:10:00.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59157'
references:
  - url: >-
      https://github.com/coollabsio/coolify/security/advisories/GHSA-5cg9-38qj-8mc3
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.01847
epssPercentile: 0.78271
ingestedAt: '2026-09-30T22:27:27.691Z'
---

## Overview

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creation is vulnerable to command injection. User input is not properly sanitized, allowing attackers to inject arbitrary shell commands that execute on the underlying server during the deployment workflow. A regular member user can exploit this vulnerability. Version 4.0.0-beta.420.7 contains a patch for the issue.

## Affected

- `coolify < 4.0.0`
- `coolify = 4.0.0`

## Remediation

Upgrade past the affected range:

- `coolify 4.0.0`