QwikSec

Security Database

CVE

CWE

Training

CVE-2025-66209

Published: Dec 23, 2025

Modified: Mar 17, 2026

PUBLISHED

CVSS v3.1

10.0

CRITICAL

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Vendor	Product	Versions
coollabsio	coolify	affected `< 4.0.0-beta.451`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-vm5p-43qh-7pmq

x_refsource_CONFIRM

https://github.com/coollabsio/coolify/pull/7375

x_refsource_MISC

https://github.com/0xrakan/coolify-cve-2025-66209-66213

x_refsource_MISC

https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.