CVE-2025-64424 - CVE House
Back to Database
Status published Critical CVE-2025-64424

Colify has command injection vulnerability in project git source

Vulnerability Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user (member) to execute system commands as root on the Coolify instance. As of time of publication, it is unclear if a patch is available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64424

Credits & Attribution

No credits recorded in the NVD database.

References

More from coollabsio

View All →
CVE-2025-66213
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path
Critical 9.4
CVE-2025-66212
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename
Critical 9.4
CVE-2025-66211
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename
Critical 9.4
CVE-2025-66210
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import
Critical 9.4
CVE-2025-66209
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup
Critical 10

Affected Vendor

Affected Software

coolify
Vulnerable Versions:
<= 4.0.0-beta.434

Timeline

Official Publish: January 5th, 2026
Last Modified: January 5th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-77

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1105 Ingress Tool Transfer
Command and Control