Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

coolify — Vulnerabilities & Security Advisories 78

All 78 CVE vulnerabilities found in coolify, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting Coolify, a self-hosted open-source platform designed for deploying and managing applications on personal servers. The collection encompasses a wide spectrum of weaknesses identified in the software, including remote code execution flaws, privilege escalation issues, and configuration errors reported over the past several years. Visitors can utilize this resource to track official vendor advisories, analyze the characteristics of specific weakness classes impacting the platform, or review the complete historical record of security incidents associated with Coolify. By centralizing these critical details, the page provides a clear view of the product's evolving security posture without requiring users to navigate disparate sources or fragmented reports. The data presented here serves as a foundational reference for security professionals, system administrators, and developers seeking to understand potential risks and implement necessary mitigations. All entries are curated to ensure accuracy and relevance, focusing strictly on confirmed issues that have been publicly disclosed or privately reported to the maintainers. This compilation aims to support proactive defense strategies by offering immediate access to essential vulnerability intelligence, enabling stakeholders to make informed decisions regarding their infrastructure security.

Vendor: coollabsio

CVE ID Title CVSS Severity Published
CVE-2025-59156 Coolify has Docker Compose Injection issue CWE-78 9.9 - 2026-01-05
CVE-2025-66213 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path CWE-78 9.9AI Critical AI 2025-12-23
CVE-2025-66212 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename CWE-78 8.8AI High AI 2025-12-23
CVE-2025-66211 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename CWE-78 8.8AI High AI 2025-12-23
CVE-2025-66210 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import CWE-78 8.8AI High AI 2025-12-23
CVE-2025-66209 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup CWE-78 10.0 Critical 2025-12-23
CVE-2025-34157 Coolify Stored Cross-Site Scripting (XSS) in Project Name Field CWE-79 5.4AI Medium AI 2025-08-27
CVE-2025-34159 Coolify Docker Compose Directive Injection in Application Deployment Workflow CWE-94 8.8AI High AI 2025-08-27
CVE-2025-34161 Coolify Git Repository Field Command Injection in Project Deployment Workflow CWE-78 8.8AI High AI 2025-08-27
CVE-2025-24025 Coolify Vulnerable to Reflected XSS on Tag Search CWE-116 5.4 - 2025-01-24
CVE-2025-22612 Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE) CWE-200 10.0 Critical 2025-01-24
CVE-2025-22611 Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE) CWE-862 10.0 Critical 2025-01-24
CVE-2025-22610 Coolify Vulnerable to OAuth Secrets Leak CWE-862 7.1 - 2025-01-24
CVE-2025-22609 Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE) CWE-862 10.0 Critical 2025-01-24
CVE-2025-22608 Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS) CWE-639 6.5 Medium 2025-01-24
CVE-2025-22607 Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak CWE-200 6.5 - 2025-01-24
CVE-2025-22606 Coolify Command Injection Vulnerability in Project Name CWE-78 8.8 - 2025-01-24
CVE-2025-22605 Coolify OS Command Injection Vulnerability in SSH Command Generation CWE-78 9.9 - 2025-01-24

All 78 known CVE vulnerabilities affecting coolify with full Chinese analysis, references, and POCs where available.