CVE-2025-64419Critical· 9.6▾ MidnightCoolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user cre…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.
coolify < 4.0.0coolify = 4.0.0Upgrade past the affected range:
coolify 4.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-64424High· 8.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases
CVE-2025-64425High· 8.1Coolify is an open-source and self-hostable tool for managing servers, applications, and databases
CVE-2025-64422Medium· 4.3Coolify is an open-source and self-hostable tool for managing servers, applications, and databases
CVE-2025-64423High· 8.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases
CVE-2025-64420Critical· 9.9Coolify is an open-source and self-hostable tool for managing servers, applications, and databases
CVE-2025-64421High· 8.0Coolify is an open-source and self-hostable tool for managing servers, applications, and databases