CVE-2025-64424CWE-77command-injection

CVE-2025-64424

High Β· published January 6, 2026

CVSS v3.1
8.8
EPSS
2%
Percentile
81.2
In the wild
Unconfirmed
What it is

🚨 A crafty command injection vulnerability lurking in Coolify lets low privileged users execute system commands as root! πŸ”₯ Think of this like a hotel with a guest who can sneak into the manager's office and change the entire reservation system β€” chaos waiting to happen! ⚠️ An attacker could wield this vulnerability to gain complete control over the Coolify instance. They could install malicious software, manipulate server configurations, or even bring services to a halt. This scenario is absolutely devastating for anyone relying on Coolify for server management!

Put simply

Think of this like a hotel with a guest who can sneak into the manager's office and change the entire reservation system β€” chaos waiting to happen! ⚠️ This command injection flaw in Coolify's git source input fields allows low privileged users to craft malicious commands that execute at the root level, compromising the entire server's integrity.

What to do

An attacker could wield this vulnerability to gain complete control over the Coolify instance. They could install malicious software, manipulate server configurations, or even bring services to a halt. This scenario is absolutely devastating for anyone relying on Coolify for server management! Immediately update Coolify to the latest version, keeping an eye out for any patches addressing this vulnerability. If you’re using an affected version, consider restricting access to the git source input fields until a fix is available. πŸ’‘ You've got this! Stay vigilant and proactive, and you'll be a security hero in no time! 🦸

The record
Technical detail
CVSS v3.1
8.8 Β· HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02064 Β· 81.2th percentile
Weakness
CWE-77 Β· Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-01-06T02:16Z
Affected products (425)
ProductVersionsFixed in
coollabs/coolify< 4.0.04.0.0
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
coollabs/coolifyall versionsβ€”
References (3)
EPSS history
Timeline
  • 05 JAN 20:45Z
    Colify has command injection vulnerability in project git source
    cvelistv5