CVE-2025-64419 Coollabs CVE debrief

Who should care

Defenders responsible for Coolify instances, DevOps teams, and security teams should assess exposure and prioritize updates. This includes reviewing current deployments, understanding the potential impact of the vulnerability, and taking steps to mitigate the risk. Additionally, operators of affected platforms, vulnerability management teams, and security teams should be aware of the vulnerability and its potential impacts on their systems and operations.

Why it matters

CVE-2025-64419 is a critical vulnerability in Coolify that allows for code execution as root. Defenders should prioritize updating to version 4.0.0-beta.445 or later and assess exposure for systems using versions prior to 4.0.0-beta.445.

• Code execution as root on Coolify instances
• Potential for lateral movement within affected networks
• Need for immediate inventory checks and version verification
• Possible data breaches or system compromise

Technical summary

Coolify, a self-hostable tool for managing servers, applications, and databases, is vulnerable to a command injection issue. Prior to version 4.0.0-beta.445, parameters from docker-compose.yaml are not sanitized when used in commands, allowing an attacker to execute commands on the Coolify instance as root if a victim user creates an application from an attacker repository. This vulnerability is a critical issue with a CVSS score of 9.6 and can lead to code execution as root, potential lateral movement within affected networks, and possible data breaches or system compromise.

Defensive priority

Defenders should prioritize updating Coolify instances to version 4.0.0-beta.445 or later, and assess exposure for systems using versions prior to 4.0.0-beta.445.

Recommended defensive actions

• Update Coolify instances to version 4.0.0-beta.445 or later
• Assess exposure for systems using versions prior to 4.0.0-beta.445
• Review and restrict repository access for applications created from untrusted sources
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not provide evidence of exploitation. The vulnerability is described as a critical issue in Coolify versions prior to 4.0.0-beta.445.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.