CVE-2025-59157 Coollabs CVE debrief

Who should care

System administrators and security teams responsible for managing servers, applications, and databases using Coolify should assess their exposure and update to the patched version.

Why it matters

This critical vulnerability allows attackers to inject arbitrary shell commands during the deployment workflow in Coolify versions prior to 4.0.0-beta.420.7. Defenders should prioritize updating to the patched version and monitor for suspicious activity.

• Potential code execution on the server
• Deployment workflow compromise
• Lateral movement within the network
• Data tampering during deployment

Technical summary

The Git Repository field in Coolify's project creation process is vulnerable to command injection. User input is not properly sanitized, allowing attackers to execute arbitrary shell commands on the underlying server during deployment. This vulnerability is patched in version 4.0.0-beta.420.7. The issue allows for potential code execution on the server, deployment workflow compromise, lateral movement within the network, and data tampering during deployment. A regular member user can exploit this vulnerability. Defenders should prioritize updating to the patched version and monitor for suspicious activity.

Defensive priority

Defenders should prioritize updating to version 4.0.0-beta.420.7 or later to mitigate this vulnerability.

Recommended defensive actions

• Update to Coolify version 4.0.0-beta.420.7 or later
• Restrict access to the Git Repository field during project creation
• Monitor for suspicious activity in deployment workflows
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in Coolify versions prior to 4.0.0-beta.420.7. User input is not properly sanitized, allowing for command injection. A patch is available in version 4.0.0-beta.420.7. This issue is exploitable by a regular member user. The vulnerability allows attackers to inject arbitrary shell commands during the deployment workflow. Evidence is based on the CVE Program record and NVD detail page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.