CVE-2025-64419— Coolify vulnerable to command injection via docker-compose.yaml parameters
Quick assessment
Affected
coollabsio coolify
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Coolify是coolLabs开源的一个开源和自托管的 Heroku/Netlify/Vercel 替代品。 Coolify 4.0.0-beta.445之前版本存在命令注入漏洞，该漏洞源于docker-compose.yaml参数清理不当，可能导致命令执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-64419
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Coolify vulnerable to command injection via docker-compose.yaml parameters
Source: CVE Program / CVE List V5
Vulnerability Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Coolify 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Coolify是coolLabs开源的一个开源和自托管的 Heroku/Netlify/Vercel 替代品。 Coolify 4.0.0-beta.445之前版本存在命令注入漏洞，该漏洞源于docker-compose.yaml参数清理不当，可能导致命令执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| coollabsio | coolify | < 4.0.0-beta.445 | - |
|
II. Public POCs for CVE-2025-64419
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 9535 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2025-64419
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-64419 (1)
Vendor Advisories for CVE-2025-64419 (1)
-
https://github.com/coollabsio/coolify/security/advisories/GHSA-234r-xrrg-m8f3 x_refsource_CONFIRM
Same Patch Batch · coollabsio · 2026-01-05 · 11 CVEs total
| CVE-2025-64420 | 10.0 CRITICAL | Coolify members can see private key of root user |
| CVE-2025-59157 | 10.0 CRITICAL | Coolify has Git Repository RCE |
| CVE-2025-64424 | Colify has command injection vulnerability in project git source | |
| CVE-2025-64421 | Coolify has a privilege escalation - low privileged user can invite themselves as an admin | |
| CVE-2025-64423 | Coolify has a Privilege Escalation - low privileged users can see and use admin invitation | |
| CVE-2025-64422 | Rate-limit bypass on login via X-Forwarded-Host header | |
| CVE-2025-64425 | Coolify has host header injection in forgot password | |
| CVE-2025-59158 | Coolify has Stored XSS in Project Name | |
| CVE-2025-59156 | Coolify has Docker Compose Injection issue | |
| CVE-2025-59955 | Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current |
IV. Related Vulnerabilities
Same product: coolify
-
CVE-2026-15507
coollabsio Coolify Policy Policies authorization -
CVE-2026-59734
Coolify: OS Command Injection in Health Check Configuration -
CVE-2026-42201
Coolify: OS Command Injection via Database Credential Fields -
CVE-2026-34158
Coolify: Command injection via single-quote breakout in Dock -
CVE-2026-34170
Coolify: Server-Side Request Forgery via attacker-controlled
Same vendor: coollabsio
-
CVE-2026-15507
coollabsio Coolify Policy Policies authorization -
CVE-2026-59734
Coolify: OS Command Injection in Health Check Configuration -
CVE-2026-42201
Coolify: OS Command Injection via Database Credential Fields -
CVE-2026-34158
Coolify: Command injection via single-quote breakout in Dock -
CVE-2026-34170
Coolify: Server-Side Request Forgery via attacker-controlled
Same weakness: CWE-77
-
CVE-2026-78141
Tenda CH22 exeCommand formexeCommand command injection -
CVE-2026-78063
Tenda CH22 editFileName formeditFileName command injection -
CVE-2026-77988
TRENDnet TEW-823DRU CLI Configuration Tool nvram_get command -
CVE-2026-77945
TRENDnet TEW-821DAP ssi upload.cgi command injection -
CVE-2026-77683
Comfast CF-N1-S mbox-config system command injection
V. Comments for CVE-2025-64419
No comments yet