Skip to content
OpenAdvisories
Critical · 9.4 Public exploit CVE-2025-34161 EUVD-2025-25912GHSA-xp99-74mm-rpv2

Coolify Git Repository Field Command Injection in Project Deployment Workflow

Published Aug 27, 2025 · Updated Nov 8, 2026 · Assigned by VulnCheck

Vendor: coolLabs Technologies Product: Coolify

Description

Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, resulting in full server compromise.

Affected products

VendorProductAffectedFixed
coolLabs Technologies Coolify < 4.0.0-beta.420.7 4.0.0-beta.420.7

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Eyodav/CVE-2025-34161 ★ 1 · Aug 25, 2025

    Authenticated low-privileged RCE in Coolify via unsanitized shell commands in the Git Repository field.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References