What’s Vulnerable › Vulnerabilities

CVE-2025-34159: Coolify Docker Compose Directive Injection in Application Deployment Workflow

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-08-27 · updated 2026-07-14
• Weakness: CWE-20

Description

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can gain full root access to the underlying server.

Affected products

• coollabsio coolify: before 4.0.0; 4.0.0-beta100, 4.0.0-beta101, 4.0.0-beta102, 4.0.0-beta103, 4.0.0-beta104, 4.0.0-beta105 (+401) — fixed in 4.0.0

How to fix

Upgrade to a fixed version: coollabsio coolify 4.0.0. Check the vendor advisory for mitigations.

References

• https://coolify.io/
• https://github.com/Eyodav/CVE-2025-34159
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7

Get alerted when CVE-2025-34159 or the next vulnerability affects your stack