What’s Vulnerable › Vulnerabilities

CVE-2025-34161: Coolify Git Repository Field Command Injection in Project Deployment Workflow

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-08-27 · updated 2026-07-14
• Weakness: CWE-20

Description

Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, resulting in full server compromise.

Affected products

• coollabsio coolify: before 4.0.0; 4.0.0-beta100, 4.0.0-beta101, 4.0.0-beta102, 4.0.0-beta103, 4.0.0-beta104, 4.0.0-beta105 (+401) — fixed in 4.0.0

How to fix

Upgrade to a fixed version: coollabsio coolify 4.0.0. Check the vendor advisory for mitigations.

References

• https://coolify.io/
• https://github.com/Eyodav/CVE-2025-34161
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7

Get alerted when CVE-2025-34161 or the next vulnerability affects your stack