Skip to content
OpenAdvisories
Critical · 10.0 Public exploit CVE-2025-66209 EUVD-2025-204961

Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup

Published Dec 23, 2025 · Updated Mar 17, 2026 · Assigned by GitHub_M

Vendor: coollabsio Product: coolify

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Affected products

VendorProductAffectedFixed
coollabsio coolify < 4.0.0-beta.451 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 2

References