CVE-2025-66209 - CVE House
Back to Database
Status published Critical CVE-2025-66209

Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup

Vulnerability Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66209

Credits & Attribution

No credits recorded in the NVD database.

References

More from coollabsio

View All →
CVE-2025-66213
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path
Critical 9.4
CVE-2025-66212
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename
Critical 9.4
CVE-2025-66211
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename
Critical 9.4
CVE-2025-66210
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import
Critical 9.4
CVE-2025-64425
Coolify has host header injection in forgot password
High 8.5

Affected Vendor

Affected Software

coolify
Vulnerable Versions:
< 4.0.0-beta.451

Timeline

Official Publish: December 23rd, 2025
Last Modified: March 17th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration