CVE-2025-66211 - Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename

Back Back to CVE browser

CRITICAL

Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename

Published Dec 23, 2025

9.4

CRITICAL

CVSS 4.0

EPSS 2.74%

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Affected products

Vendor Coollabsio Product Coolify Default
n/a
- Version
  < 4.0.0-beta.451
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Coollabsio

Coolify

n/a

Version	Status	Constraints
< 4.0.0-beta.451	affected	-

Remediation

No remediation recorded yet.

Metrics

2.74% 0.02738

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.02738

Score over time

2025-2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	2.74% (0.02738)	85.64th	v5 (v2026.06.15)
Jun 15, 2026	2.70% (0.02701)	83.94th	v5 (v2026.06.15)
Dec 24, 2025	0.57% (0.00571)	67.92th	v4 (v2025.03.14)

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

https://github.com/0xrakan/coolify-cve-2025-66209-66213
x_refsource_MISCExploitThird Party Advisory
https://github.com/coollabsio/coolify/pull/7375
x_refsource_MISCIssue Tracking
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451
x_refsource_MISCRelease Notes
https://github.com/coollabsio/coolify/security/advisories/GHSA-24mp-fc9q-c884
exploitx_refsource_CONFIRM

Link	Providers	Tags
https://github.com/0xrakan/coolify-cve-2025-66209-66213		x_refsource_MISCExploitThird Party Advisory
https://github.com/coollabsio/coolify/pull/7375		x_refsource_MISCIssue Tracking
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451		x_refsource_MISCRelease Notes
https://github.com/coollabsio/coolify/security/advisories/GHSA-24mp-fc9q-c884		exploitx_refsource_CONFIRM