Skip to content
OpenAdvisories
High WID-SEC-2026-0031 16 CVEs

Coolify: Mehrere Schwachstellen

Published Jan 6, 2026 · Updated Jan 6, 2026 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Coolify ausnutzen, um beliebigen Code auszuführen – sogar mit Administratorrechten –, um erweiterte Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder vertrauliche Informationen offenzulegen.

Product

Coolify ist eine Open-Source-Plattform zur Vereinfachung der Bereitstellung und Verwaltung von Anwendungen.

Vulnerabilities 16

  • Critical 10.0
    CVE-2025-59157

    Coolify has Git Repository RCE

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creation is vulnerable to command injection. User input is not properly sanitized, a…

    coollabsio coolify
  • Critical 10.0
    CVE-2025-64420

    Coolify members can see private key of root user

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This…

    coollabsio coolify
  • Critical 10.0
    CVE-2025-66209 Public exploit

    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service ma…

    coollabsio coolify
  • Critical 9.7
    CVE-2025-64419

    Coolify vulnerable to command injection via docker-compose.yaml parameters

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application fr…

    coollabsio coolify
  • Critical 9.4
    CVE-2025-59156

    Coolify has Docker Compose Injection issue

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)*vulnerability exists in Coolify's application deployment workflow. This flaw allows a low-priv…

    coollabsio coolify
  • Critical 9.4
    CVE-2025-59158

    Coolify has Stored XSS in Project Name

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An aut…

    coollabsio coolify
  • Critical 9.4
    CVE-2025-64424 Public exploit

    Colify has command injection vulnerability in project git source

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low …

    coollabsio coolify
  • Critical 9.4
    CVE-2025-66210

    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Import functionality allows users with application/service ma…

    coollabsio coolify
  • Critical 9.4
    CVE-2025-66211

    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/ser…

    coollabsio coolify
  • Critical 9.4
    CVE-2025-66212

    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Dynamic Proxy Configuration Filename handling allows users with applic…

    coollabsio coolify
  • Critical 9.4
    CVE-2025-66213

    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the File Storage Directory Mount Path functionality allows users with appl…

    coollabsio coolify
  • High 8.7
    CVE-2025-64421

    Coolify has a privilege escalation - low privileged user can invite themselves as an admin user

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can invite a high privileged user. At first, the application will throw…

    coollabsio coolify
  • High 8.5
    CVE-2025-64425

    Coolify has host header injection in forgot password

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim, and modify the host header of the request to a…

    coollabsio coolify
  • High 7.7
    CVE-2025-64423

    Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can see and use invitation links sent to an administrator. When they us…

    coollabsio coolify
  • Medium 5.7
    CVE-2025-59955

    Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/te…

    coollabsio coolify
  • Medium 5.5
    CVE-2025-64422

    Rate-limit bypass on login via X-Forwarded-Host header

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-For…

    coollabsio coolify

Revision history

  1. #1

    Initiale Fassung

References