Authenticated Command Injection in Coolify Database Import Enables Root RCE

Publication date: 2025-12-23

Last updated on: 2026-03-17

Assigner: GitHub, Inc.

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Import functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in import operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-23

Last Modified

2026-03-17

Generated

2026-07-06

AI Q&A

2025-12-24

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66210

Affected Vendors & Products

Vendor	Product	Version / Range
coolify	coolify	4.0.0-beta.451

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an authenticated command injection in Coolify's Database Import functionality prior to version 4.0.0-beta.451. Users with application or service management permissions can exploit it by using database names that are passed directly to shell commands without sanitization, allowing them to execute arbitrary commands as root on managed servers.

Impact Analysis

The vulnerability allows attackers with certain permissions to execute arbitrary commands as root on managed servers, potentially leading to full remote code execution. This can compromise the entire server, leading to data theft, service disruption, or further attacks within the network.

Mitigation Strategies

Upgrade Coolify to version 4.0.0-beta.451 or later, as this version fixes the authenticated command injection vulnerability in the Database Import functionality.

Hi! I’m here to help you understand CVE-2025-66210. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70