CVE-2025-64419
Severity CVSS v4.0:
Pending analysis
Type:
CWE-77
Command Injection
Publication date:
05/01/2026
Last modified:
12/01/2026
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.
Impact
Base Score 3.x
9.60
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:coollabs:coolify:*:*:*:*:*:*:*:* | 4.0.0 (excluding) | |
| cpe:2.3:a:coollabs:coolify:4.0.0:beta100:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta101:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta102:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta103:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta104:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta105:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta106:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta107:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta108:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta109:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta110:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta111:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta112:*:*:*:*:*:* | ||
| cpe:2.3:a:coollabs:coolify:4.0.0:beta113:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page