Skip to content
OpenAdvisories
Critical · 9.7 CVE-2025-64419 EUVD-2025-206244

Coolify vulnerable to command injection via docker-compose.yaml parameters

Published Jan 5, 2026 · Updated Jan 5, 2026 · Assigned by GitHub_M

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.

Affected products

VendorProductAffectedFixed
coollabsio coolify < 4.0.0-beta.445 —

Advisories 1

References