Coolify Command Injection Flaws Grant Root Access

Security researchers disclosed five critical command injection vulnerabilities in Coolify, the open-source platform many developers use to self-host applications and databases. All five flaws allow authenticated users to execute commands as root on the host system—effectively granting complete server compromise. With roughly 52,890 exposed instances identified globally, the attack surface is substantial.

Coolify developers patched all vulnerabilities in version 4.0.0-beta.451. Anyone running earlier versions should update immediately.

What Is Coolify?

Coolify positions itself as an open-source, self-hostable alternative to platforms like Heroku, Netlify, and Vercel. It lets developers deploy applications, databases, and services on their own infrastructure through a web-based interface. The platform manages Docker containers and requires elevated privileges to operate.

That privileged position makes these vulnerabilities particularly severe. Coolify runs with root access because it needs to manage containers and host system resources. Command injection into this context escapes the application boundary entirely.

The Vulnerabilities

Five distinct command injection flaws were identified, all sharing a common cause: insufficient sanitization of user-controlled parameters passed to shell commands.

CVE-2025-66209 (CVSS 9.4) - Database backup operations accept unsanitized database names. Attackers inject shell metacharacters into backup requests, achieving code execution during the backup process.

CVE-2025-66210 (CVSS 10.0) - Similar injection in database restoration workflows.

CVE-2025-66211 (CVSS 10.0) - PostgreSQL initialization script filename processing allows command injection.

CVE-2025-66212 (CVSS 10.0) - Project name field vulnerable to injection during certain operations.

CVE-2025-66213 (CVSS 10.0) - File path handling in deployment workflows permits command injection.

The affected functionality processes database names, file paths, and configuration filenames without proper escaping. Shell metacharacters like semicolons, backticks, or $(command) syntax pass directly to system shells.

Exposure Analysis

As of January 8, Censys data shows approximately 52,890 Coolify instances exposed to the internet. Geographic distribution concentrates in developer-heavy regions:

• Germany: 15,000 instances
• United States: 9,800 instances
• France: 8,000 instances
• Brazil: 4,200 instances
• Finland: 3,400 instances

These numbers represent only internet-facing deployments. Internal instances behind corporate firewalls add to the total, though exploitation requires authenticated access.

Attack Requirements

Exploitation requires authentication to Coolify's web interface. This isn't a high bar—many self-hosted instances use weak credentials or default configurations. Once logged in with any privileges that include application or service management, attackers can target any of the five injection points.

The attack chain works like this:

1. Attacker authenticates to Coolify (legitimate credentials, stolen session, or compromised account)
2. Attacker triggers one of the vulnerable functions with injected shell commands
3. Coolify passes the malicious input to a system shell without sanitization
4. Commands execute as root on the host system
5. Attacker achieves complete host compromise and container escape

Impact

Successful exploitation grants root access to the underlying server. From there, attackers can:

• Access all containers and their data
• Steal secrets and environment variables from deployed applications
• Modify application code or configurations
• Pivot to other systems accessible from the compromised host
• Deploy cryptocurrency miners or other malware
• Establish persistent backdoors

For organizations using Coolify to host production applications, this means their entire self-hosted infrastructure becomes compromised through a single vulnerability.

Remediation

Upgrade to Coolify version 4.0.0-beta.451 or later. The development team implemented input validation and shell argument escaping across all affected functionality.

For immediate steps:

1. Check your Coolify version in the admin interface
2. If below 4.0.0-beta.451, update immediately
3. Review access logs for unusual activity
4. Audit user accounts and remove unnecessary privileges
5. Consider network restrictions limiting who can reach the Coolify interface

Technical details and proof-of-concept code are being withheld to give users time to update. That window won't last indefinitely.