CVE-2025-66211
Published: 23 December 2025
Summary
CVE-2025-66211 is a high-severity OS Command Injection (CWE-78) vulnerability in Coollabs Coolify. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 35.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of PostgreSQL init script filenames before passing to shell commands, preventing command injection by blocking malicious payloads.
Restricts PostgreSQL init script filenames to organization-defined safe patterns or conditions, blocking injection attempts through disallowed characters or formats.
Remediates the specific command injection flaw by identifying, testing, and installing the patch in Coolify version 4.0.0-beta.451 or later.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated command injection in shell via PostgreSQL init script filenames enables remote exploitation of the service (T1210), Unix shell execution (T1059.004), and privilege escalation to root (T1068).
NVD Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/service management permissions to execute arbitrary commands as root…
more
on managed servers. PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
Deeper analysisAI
CVE-2025-66211 is an authenticated command injection vulnerability (CWE-78) in the PostgreSQL Init Script Filename handling of Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The issue affects versions prior to 4.0.0-beta.451, where PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling attackers to inject and execute arbitrary commands.
Attackers with application or service management permissions can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants full remote code execution as root on the managed servers, resulting in high confidentiality, integrity, and availability impacts, as reflected in the CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Mitigation is available in Coolify version 4.0.0-beta.451, which addresses the vulnerability through a fix detailed in the associated pull request. Official security advisories and release notes on GitHub recommend upgrading to this version or later to prevent exploitation.
Details
- CWE(s)