CVE-2025-66212
Published: 23 December 2025
Summary
CVE-2025-66212 is a critical-severity OS Command Injection (CWE-78) vulnerability in Coollabs Coolify. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 13.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Coolify, an open-source and self-hostable tool for managing servers, applications, and databases, is affected by CVE-2025-66212, an authenticated command injection vulnerability (CWE-78) in the Dynamic Proxy Configuration Filename handling prior to version 4.0.0-beta.451. The flaw occurs because proxy configuration filenames are passed directly to shell commands without proper escaping, allowing injection of malicious payloads.
Attackers with application or service management permissions can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N), resulting in high impacts to confidentiality, integrity, and availability (CVSS 8.8; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation enables execution of arbitrary commands as root on managed servers, leading to full remote code execution.
Version 4.0.0-beta.451 addresses the vulnerability by fixing the command injection issue. Official mitigation guidance is provided in the Coolify security advisory (GHSA-q7rg-2j7p-83gp), the associated pull request (#7375), and the release notes for v4.0.0-beta.451. Security practitioners should upgrade affected instances immediately.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204955
Vulnerability details
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Dynamic Proxy Configuration Filename handling allows users with application/service management permissions to execute arbitrary commands as…
more
root on managed servers. Proxy configuration filenames are passed to shell commands without proper escaping, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated command injection (CWE-78) in proxy configuration directly enables Unix Shell execution (T1059.004), exploitation of remote service (T1210), and privilege escalation to root (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of proxy configuration filenames before passing to shell commands, directly preventing command injection exploits.
Mandates identification, reporting, and timely correction of the command injection flaw through patching to version 4.0.0-beta.451.
Enforces least privilege on Coolify processes to restrict arbitrary command execution to non-root even if injection succeeds.