CVE-2025-66213CWE-78command-injection

CVE-2025-66213

High ยท published December 24, 2025

CVSS v3.1
8.8
EPSS
3%
Percentile
87.9
In the wild
Unconfirmed
What it is

๐Ÿ”ฅ An authenticated command injection vulnerability in Coolify lets users with management permissions execute arbitrary commands as root โ€” talk about a security nightmare! Think of it like a restaurant where the chef can directly change the menu without any oversight. If no one checks what the chef is cooking up, they could serve anything, even dishes that could harm the customers! ๐Ÿฝ๏ธ This vulnerability could allow malicious users to run any command on the host system, potentially compromising sensitive data or taking complete control over the server. It's like giving someone a master key to your home without a background check โ€” absolutely devastating!

Put simply

Think of it like a restaurant where the chef can directly change the menu without any oversight. If no one checks what the chef is cooking up, they could serve anything, even dishes that could harm the customers! ๐Ÿฝ๏ธ The flaw exists in the File Storage Directory Mount Path functionality prior to version 4.0.0-beta.451, where the file_storage_directory_source parameter is directly passed to shell commands without proper sanitization, allowing remote code execution.

What to do

This vulnerability could allow malicious users to run any command on the host system, potentially compromising sensitive data or taking complete control over the server. It's like giving someone a master key to your home without a background check โ€” absolutely devastating! To secure your systems, immediately upgrade to version 4.0.0-beta.451. Additionally, review user permissions and limit access to only those who absolutely need it. Regularly audit your application to ensure no unauthorized changes slip through! You've got this! Just follow these steps and your security hero status will be locked in tight! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
8.8 ยท HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03148 ยท 87.9th percentile
Weakness
CWE-78 ยท Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-12-24T03:15Z
Affected products (441)
ProductVersionsFixed in
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolify< 4.0.04.0.0
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
References (5)
EPSS history
Timeline
  • 23 DEC 22:06Z
    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path
    cvelistv5