CVE-2025-66213

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the File Storage Directory Mount Path functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. The file_storage_directory_source parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. Version 4.0.0-beta.451 fixes the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
coollabsio	coolify	< 4.0.0-beta.451

References

https://github.com/0xrakan/coolify-cve-2025-66209-66213Exploit, Third Party Advisory
https://github.com/coollabsio/coolify/pull/7375Issue Tracking, Patch
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451Release Notes
https://github.com/coollabsio/coolify/security/advisories/GHSA-cj2c-9jx8-j427
https://github.com/coollabsio/coolify/security/advisories/GHSA-cj2c-9jx8-j427

Timeline

Published: Dec 23, 2025
Last modified: Oct 19, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-662148.8Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 conta CVE-2025-662156.8OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the t CVE-2025-662169.8AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Me CVE-2025-662177.5AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of CVE-2025-662199.8willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulner CVE-2025-662207.1Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher fo CVE-2025-662215.3Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Wi CVE-2025-662229.6DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability CVE-2025-662238.4OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, rem CVE-2025-662248.8OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralizati CVE-2025-662258.8OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce t CVE-2025-66234.3The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection