CVE-2025-66211CWE-78command-injection

CVE-2025-66211

High ยท published December 24, 2025

CVSS v3.1
8.8
EPSS
3%
Percentile
86.0
In the wild
Unconfirmed
What it is

๐Ÿšจ A single line in your PostgreSQL init script could let an attacker run any command as root! ๐Ÿ”ฅ Think of it as letting someone order from a restaurant menu that has no checks โ€” they could ask for anything, from a simple salad to a gourmet feast, and you'd have to serve it without question! This vulnerability could lead to an absolute nightmare โ€” an attacker could gain complete control over your managed servers, potentially altering, deleting, or leaking critical data. With the ability to execute arbitrary commands, the consequences could be devastating for your entire application ecosystem.

Put simply

Think of it as letting someone order from a restaurant menu that has no checks โ€” they could ask for anything, from a simple salad to a gourmet feast, and you'd have to serve it without question! The authenticated command injection flaw in Coolify allows users with application/service management permissions to pass unvalidated PostgreSQL script filenames to shell commands, enabling remote code execution as root.

What to do

This vulnerability could lead to an absolute nightmare โ€” an attacker could gain complete control over your managed servers, potentially altering, deleting, or leaking critical data. With the ability to execute arbitrary commands, the consequences could be devastating for your entire application ecosystem. Immediately upgrade Coolify to version 4.0.0-beta.451 or later to patch this vulnerability. Additionally, audit your PostgreSQL initialization scripts and ensure proper validation measures are in place to prevent future exploits. You've got this! With these steps, your servers will be on the road to safety in no time! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
8.8 ยท HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02738 ยท 86.0th percentile
Weakness
CWE-78 ยท Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-12-24T03:15Z
Affected products (441)
ProductVersionsFixed in
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolify< 4.0.04.0.0
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
References (5)
EPSS history
Timeline
  • 23 DEC 22:00Z
    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename
    cvelistv5