Back to search
CVE-2025-34159
Published: Aug 27, 2025
Modified: May 26, 2026
PUBLISHED
Description
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can gain full root access to the underlying server.
| Vendor | Product | Versions |
|---|---|---|
coolLabs Technologies | Coolify | affected 0 - < 4.0.0-beta.420.7 |
References
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7
vendor-advisory
patch
https://coolify.io/
product
https://github.com/Eyodav/CVE-2025-34159
technical-description
exploit
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now