← Voltar para CVEs
CVE-2025-66209
CRITICAL9.9
Descricao
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
Detalhes CVE
Pontuacao CVSS v3.19.9
SeveridadeCRITICAL
Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vetor de ataqueNETWORK
ComplexidadeLOW
Privilegios necessariosLOW
Interacao do usuarioNONE
Publicado12/23/2025
Ultima modificacao3/17/2026
Fontenvd
Avistamentos honeypot0
Produtos afetados
coollabs:coolify
Fraquezas (CWE)
CWE-78
Referencias
https://github.com/0xrakan/coolify-cve-2025-66209-66213(security-advisories@github.com)
https://github.com/coollabsio/coolify/pull/7375(security-advisories@github.com)
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451(security-advisories@github.com)
https://github.com/coollabsio/coolify/security/advisories/GHSA-vm5p-43qh-7pmq(security-advisories@github.com)
https://github.com/coollabsio/coolify/security/advisories/GHSA-vm5p-43qh-7pmq(134c704f-9b21-4f2e-91b3-4a467353bcc0)
Correlacoes IOC
Sem correlacoes registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.