CVE-2025-64424 Coollabs CVE debrief

Who should care

System administrators, DevOps teams, and security professionals responsible for managing and securing Coolify instances should be aware of this vulnerability and take immediate action to patch or mitigate it.

Why it matters

This critical vulnerability in Coolify could allow low-privileged users to execute system commands as root, potentially leading to a complete compromise of the instance and connected systems. Defenders should prioritize patching, restrict access, and implement additional monitoring and logging to detect potential exploitation attempts.

• Potential elevation of privileges for low-privileged users
• Possible execution of arbitrary system commands as root
• Potential compromise of the Coolify instance and connected systems
• Need for verification of patch availability and application

Technical summary

A command injection vulnerability exists in the git source input fields of a resource in Coolify versions up to and including v4.0.0-beta.434, allowing a low-privileged user (member) to execute system commands as root on the Coolify instance. This issue is particularly concerning as it could enable an attacker to gain elevated privileges and potentially take control of the affected system. The vulnerability is confirmed based on official CVE Program and NVD records, and defenders should prioritize patching or mitigating this vulnerability as soon as possible.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability as soon as possible, especially in environments where low-privileged users have access to the Coolify instance.

Recommended defensive actions

• Patch or upgrade to a version of Coolify that addresses this vulnerability.
• Implement additional monitoring and logging to detect potential exploitation attempts.
• Restrict access to the Coolify instance to only trusted users and networks.
• Consider implementing compensating controls, such as Web Application Firewalls (WAFs), to help mitigate potential attacks.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed to exist in Coolify versions up to and including v4.0.0-beta.434, based on official CVE Program and NVD records. Defenders should verify patch availability, application, and implement additional monitoring to detect potential exploitation attempts. The CVE Program and NVD provide official records and assessments of this vulnerability, but the exact scope of affected systems and potential impact is still being investigated. Limited source detail is available, and defenders should exercise caution when rem

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.