Executive Summary

CVE-2025-64424 is a critical command injection vulnerability in Coolify versions up to v4.0.0-beta.434. It occurs because user input in the git source repository URL fields is not properly sanitized, allowing a low-privileged user (member) to inject and execute arbitrary system commands as root on the Coolify instance. This happens through the function executeInDocker, which constructs shell commands by embedding user input directly, enabling remote command execution with root privileges. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a full system compromise of the Coolify instance. An attacker with low privileges can execute arbitrary commands as root, potentially gaining complete control over the server, accessing sensitive data, disrupting services, or using the compromised system to attack other systems. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious git source URL inputs containing shell command delimiters or unusual payloads in Coolify's git source input fields. Since the vulnerability involves command injection via git repository URLs, inspecting these inputs for special characters or commands is key. Additionally, monitoring network traffic for unexpected outbound requests (e.g., curl commands to attacker-controlled domains) from the Coolify server may indicate exploitation attempts. Specific commands are not provided, but administrators can search logs or database entries for git URLs containing suspicious characters such as ';', '|', or '`'. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting or disabling the ability for low-privileged users (members) to input or modify git source URLs until a patch is available. Administrators should monitor and audit git source inputs for malicious payloads and consider isolating the Coolify instance from untrusted networks to reduce exposure. Since no patch is available at the time of reporting, applying strict input validation or sanitization manually, or limiting user privileges, can help reduce risk. [1]

Useful 0 Not Useful 0