Read the docs
TI-2025-16492 Aliases CVE-2025-22606

Coolify Command Injection Vulnerability in Project Name

Priority HIGH 72CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes unescaped characters, such as single quotes (`'`), it breaks out of the intended command structure, allowing attackers to execute arbitrary commands on the host system. This vulnerability allows attackers to execute arbitrary commands on the host server, which could result in full system compromise; create, modify, or delete sensitive system files; and escalate privileges depending on the permissions of the executed process. Attackers with access to project management features could exploit this flaw to gain unauthorized control over the host environment. Version 4.0.0-beta.359 fixes this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00286 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed coolify (coollabsio): 4.0.0-beta.359

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
coollabsiocoolifybefore 4.0.0-beta.3594.0.0-beta.359Patch availableCNA
  • coolify Vendorcoollabsio Affected before 4.0.0-beta.359 Fixed in 4.0.0-beta.359 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:coollabs:coolify:4.0.0:beta358:*:*:*:*:*:*4.0.0 beta358Vulnerablecoollabsio
  • cpe:2.3:a:coollabs:coolify:4.0.0:beta358:*:*:*:*:*:* Versions 4.0.0 beta358 Vulnerable ·coollabsio

Remediation

  • Fix · CNA coolify (coollabsio) Fixed in 4.0.0-beta.359

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-22606

References

Exploit 1

  • TI-2025-40716 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path CVSS 4.0CRITICAL 9.4
  • TI-2025-40715 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename CVSS 4.0CRITICAL 9.4
  • TI-2025-40714 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename CVSS 4.0CRITICAL 9.4
  • TI-2025-40713 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import CVSS 4.0CRITICAL 9.4
  • TI-2025-40712 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup CVSS 3.1CRITICAL 10.0
  • TI-2025-16498 Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE) CVSS 3.1CRITICAL 10.0
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences