CVE-2025-66209: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command…

PriorityP267high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

3.76%

88.5th percentile

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
coollabs	coolify	< 4.0.0	4.0.0
coollabs	coolify	—	—
coollabsio	coolify	< 4.0.0-beta.451	4.0.0-beta.451

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.