CVE-2025-59156

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)*vulnerability exists in Coolify's application deployment workflow. This flaw allows a low-privileged member to inject arbitrary Docker Compose directives during project creation or updates. By defining a malicious service that mounts the host filesystem, an attacker can achieve root-level command execution on the host OS, completely bypassing container isolation. Version 4.0.0-beta.420.7 contains a patch for the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jan 5, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-591578.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the G CVE-2025-591588.0Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including CVE-2025-591599.6SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2025-59165.6A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing CVE-2025-591602.7Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation o CVE-2025-591612.7Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficie CVE-2025-591628.8color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was CVE-2025-591632.1vet is an open source software supply chain security tool. Versions 1.12.4 and below are vulnerable to a DNS rebinding attack due to lack of CVE-2025-59175.0A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and CVE-2025-591719.8Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote CVE-2025-591728.5Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing a CVE-2025-591746.5Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially c