CVE-2025-59156 - CVE House
Back to Database
Status published Critical CVE-2025-59156

Coolify has Docker Compose Injection issue

Vulnerability Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)*vulnerability exists in Coolify's application deployment workflow. This flaw allows a low-privileged member to inject arbitrary Docker Compose directives during project creation or updates. By defining a malicious service that mounts the host filesystem, an attacker can achieve root-level command execution on the host OS, completely bypassing container isolation. Version 4.0.0-beta.420.7 contains a patch for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59156

Credits & Attribution

No credits recorded in the NVD database.

References

More from coollabsio

View All →
CVE-2025-66213
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path
Critical 9.4
CVE-2025-66212
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename
Critical 9.4
CVE-2025-66211
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename
Critical 9.4
CVE-2025-66210
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import
Critical 9.4
CVE-2025-66209
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup
Critical 10

Affected Vendor

Affected Software

coolify
Vulnerable Versions:
< 4.0.0-beta.420.7

Timeline

Official Publish: January 5th, 2026
Last Modified: January 5th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration