CVE-2025-22605
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Starting in version 4.0.0-beta.18 and prior to 4.0.0-beta.253, a vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local Coolify container, gaining access to data and private keys or tokens of other users/teams. The ability to inject malicious commands into the Coolify container gives authenticated attackers the ability to fully retrieve and control the data and availability of the software. Centrally hosted Coolify instances (open registration and/or multiple teams with potentially untrustworthy users) are especially at risk, as sensitive data of all users and connected servers can be leaked by any user. Additionally, attackers are able to modify the running software, potentially deploying malicious images to remote nodes or generally changing its behavior. Version 4.0.0-beta.253 patches this issue.
| Software | From | Fixed in |
|---|---|---|
| coollabs / coolify | 4.0.0-beta100 | 4.0.0-beta100.x |
| coollabs / coolify | 4.0.0-beta101 | 4.0.0-beta101.x |
| coollabs / coolify | 4.0.0-beta102 | 4.0.0-beta102.x |
| coollabs / coolify | 4.0.0-beta103 | 4.0.0-beta103.x |
| coollabs / coolify | 4.0.0-beta104 | 4.0.0-beta104.x |
| coollabs / coolify | 4.0.0-beta105 | 4.0.0-beta105.x |
| coollabs / coolify | 4.0.0-beta106 | 4.0.0-beta106.x |
| coollabs / coolify | 4.0.0-beta107 | 4.0.0-beta107.x |
| coollabs / coolify | 4.0.0-beta108 | 4.0.0-beta108.x |
| coollabs / coolify | 4.0.0-beta109 | 4.0.0-beta109.x |
| coollabs / coolify | 4.0.0-beta110 | 4.0.0-beta110.x |
| coollabs / coolify | 4.0.0-beta111 | 4.0.0-beta111.x |
| coollabs / coolify | 4.0.0-beta112 | 4.0.0-beta112.x |
| coollabs / coolify | 4.0.0-beta113 | 4.0.0-beta113.x |
| coollabs / coolify | 4.0.0-beta114 | 4.0.0-beta114.x |
| coollabs / coolify | 4.0.0-beta115 | 4.0.0-beta115.x |
| coollabs / coolify | 4.0.0-beta116 | 4.0.0-beta116.x |
| coollabs / coolify | 4.0.0-beta117 | 4.0.0-beta117.x |
| coollabs / coolify | 4.0.0-beta118 | 4.0.0-beta118.x |
| coollabs / coolify | 4.0.0-beta119 | 4.0.0-beta119.x |
| coollabs / coolify | 4.0.0-beta120 | 4.0.0-beta120.x |
| coollabs / coolify | 4.0.0-beta121 | 4.0.0-beta121.x |
| coollabs / coolify | 4.0.0-beta122 | 4.0.0-beta122.x |
| coollabs / coolify | 4.0.0-beta123 | 4.0.0-beta123.x |
| coollabs / coolify | 4.0.0-beta124 | 4.0.0-beta124.x |
| coollabs / coolify | 4.0.0-beta125 | 4.0.0-beta125.x |
| coollabs / coolify | 4.0.0-beta126 | 4.0.0-beta126.x |
| coollabs / coolify | 4.0.0-beta127 | 4.0.0-beta127.x |
| coollabs / coolify | 4.0.0-beta128 | 4.0.0-beta128.x |
| coollabs / coolify | 4.0.0-beta129 | 4.0.0-beta129.x |
| coollabs / coolify | 4.0.0-beta130 | 4.0.0-beta130.x |
| coollabs / coolify | 4.0.0-beta131 | 4.0.0-beta131.x |
| coollabs / coolify | 4.0.0-beta132 | 4.0.0-beta132.x |
| coollabs / coolify | 4.0.0-beta133 | 4.0.0-beta133.x |
| coollabs / coolify | 4.0.0-beta134 | 4.0.0-beta134.x |
| coollabs / coolify | 4.0.0-beta135 | 4.0.0-beta135.x |
| coollabs / coolify | 4.0.0-beta136 | 4.0.0-beta136.x |
| coollabs / coolify | 4.0.0-beta137 | 4.0.0-beta137.x |
| coollabs / coolify | 4.0.0-beta138 | 4.0.0-beta138.x |
| coollabs / coolify | 4.0.0-beta139 | 4.0.0-beta139.x |
| coollabs / coolify | 4.0.0-beta140 | 4.0.0-beta140.x |
| coollabs / coolify | 4.0.0-beta141 | 4.0.0-beta141.x |
| coollabs / coolify | 4.0.0-beta142 | 4.0.0-beta142.x |
| coollabs / coolify | 4.0.0-beta143 | 4.0.0-beta143.x |
| coollabs / coolify | 4.0.0-beta144 | 4.0.0-beta144.x |
| coollabs / coolify | 4.0.0-beta145 | 4.0.0-beta145.x |
| coollabs / coolify | 4.0.0-beta146 | 4.0.0-beta146.x |
| coollabs / coolify | 4.0.0-beta147 | 4.0.0-beta147.x |
| coollabs / coolify | 4.0.0-beta148 | 4.0.0-beta148.x |
| coollabs / coolify | 4.0.0-beta149 | 4.0.0-beta149.x |
| coollabs / coolify | 4.0.0-beta150 | 4.0.0-beta150.x |
| coollabs / coolify | 4.0.0-beta151 | 4.0.0-beta151.x |
| coollabs / coolify | 4.0.0-beta152 | 4.0.0-beta152.x |
| coollabs / coolify | 4.0.0-beta153 | 4.0.0-beta153.x |
| coollabs / coolify | 4.0.0-beta154 | 4.0.0-beta154.x |
| coollabs / coolify | 4.0.0-beta155 | 4.0.0-beta155.x |
| coollabs / coolify | 4.0.0-beta156 | 4.0.0-beta156.x |
| coollabs / coolify | 4.0.0-beta157 | 4.0.0-beta157.x |
| coollabs / coolify | 4.0.0-beta158 | 4.0.0-beta158.x |
| coollabs / coolify | 4.0.0-beta159 | 4.0.0-beta159.x |
| coollabs / coolify | 4.0.0-beta160 | 4.0.0-beta160.x |
| coollabs / coolify | 4.0.0-beta161 | 4.0.0-beta161.x |
| coollabs / coolify | 4.0.0-beta162 | 4.0.0-beta162.x |
| coollabs / coolify | 4.0.0-beta163 | 4.0.0-beta163.x |
| coollabs / coolify | 4.0.0-beta164 | 4.0.0-beta164.x |
| coollabs / coolify | 4.0.0-beta165 | 4.0.0-beta165.x |
| coollabs / coolify | 4.0.0-beta166 | 4.0.0-beta166.x |
| coollabs / coolify | 4.0.0-beta167 | 4.0.0-beta167.x |
| coollabs / coolify | 4.0.0-beta168 | 4.0.0-beta168.x |
| coollabs / coolify | 4.0.0-beta169 | 4.0.0-beta169.x |
| coollabs / coolify | 4.0.0-beta170 | 4.0.0-beta170.x |
| coollabs / coolify | 4.0.0-beta171 | 4.0.0-beta171.x |
| coollabs / coolify | 4.0.0-beta172 | 4.0.0-beta172.x |
| coollabs / coolify | 4.0.0-beta173 | 4.0.0-beta173.x |
| coollabs / coolify | 4.0.0-beta174 | 4.0.0-beta174.x |
| coollabs / coolify | 4.0.0-beta175 | 4.0.0-beta175.x |
| coollabs / coolify | 4.0.0-beta176 | 4.0.0-beta176.x |
| coollabs / coolify | 4.0.0-beta177 | 4.0.0-beta177.x |
| coollabs / coolify | 4.0.0-beta178 | 4.0.0-beta178.x |
| coollabs / coolify | 4.0.0-beta179 | 4.0.0-beta179.x |
| coollabs / coolify | 4.0.0-beta18 | 4.0.0-beta18.x |
| coollabs / coolify | 4.0.0-beta180 | 4.0.0-beta180.x |
| coollabs / coolify | 4.0.0-beta181 | 4.0.0-beta181.x |
| coollabs / coolify | 4.0.0-beta182 | 4.0.0-beta182.x |
| coollabs / coolify | 4.0.0-beta183 | 4.0.0-beta183.x |
| coollabs / coolify | 4.0.0-beta184 | 4.0.0-beta184.x |
| coollabs / coolify | 4.0.0-beta185 | 4.0.0-beta185.x |
| coollabs / coolify | 4.0.0-beta186 | 4.0.0-beta186.x |
| coollabs / coolify | 4.0.0-beta187 | 4.0.0-beta187.x |
| coollabs / coolify | 4.0.0-beta188 | 4.0.0-beta188.x |
| coollabs / coolify | 4.0.0-beta189 | 4.0.0-beta189.x |
| coollabs / coolify | 4.0.0-beta19 | 4.0.0-beta19.x |
| coollabs / coolify | 4.0.0-beta190 | 4.0.0-beta190.x |
| coollabs / coolify | 4.0.0-beta191 | 4.0.0-beta191.x |
| coollabs / coolify | 4.0.0-beta192 | 4.0.0-beta192.x |
| coollabs / coolify | 4.0.0-beta193 | 4.0.0-beta193.x |
| coollabs / coolify | 4.0.0-beta194 | 4.0.0-beta194.x |
| coollabs / coolify | 4.0.0-beta195 | 4.0.0-beta195.x |
| coollabs / coolify | 4.0.0-beta196 | 4.0.0-beta196.x |
| coollabs / coolify | 4.0.0-beta197 | 4.0.0-beta197.x |
| coollabs / coolify | 4.0.0-beta198 | 4.0.0-beta198.x |
| coollabs / coolify | 4.0.0-beta199 | 4.0.0-beta199.x |
| coollabs / coolify | 4.0.0-beta20 | 4.0.0-beta20.x |
| coollabs / coolify | 4.0.0-beta200 | 4.0.0-beta200.x |
| coollabs / coolify | 4.0.0-beta201 | 4.0.0-beta201.x |
| coollabs / coolify | 4.0.0-beta202 | 4.0.0-beta202.x |
| coollabs / coolify | 4.0.0-beta203 | 4.0.0-beta203.x |
| coollabs / coolify | 4.0.0-beta204 | 4.0.0-beta204.x |
| coollabs / coolify | 4.0.0-beta205 | 4.0.0-beta205.x |
| coollabs / coolify | 4.0.0-beta206 | 4.0.0-beta206.x |
| coollabs / coolify | 4.0.0-beta207 | 4.0.0-beta207.x |
| coollabs / coolify | 4.0.0-beta208 | 4.0.0-beta208.x |
| coollabs / coolify | 4.0.0-beta209 | 4.0.0-beta209.x |
| coollabs / coolify | 4.0.0-beta21 | 4.0.0-beta21.x |
| coollabs / coolify | 4.0.0-beta211 | 4.0.0-beta211.x |
| coollabs / coolify | 4.0.0-beta212 | 4.0.0-beta212.x |
| coollabs / coolify | 4.0.0-beta213 | 4.0.0-beta213.x |
| coollabs / coolify | 4.0.0-beta214 | 4.0.0-beta214.x |
| coollabs / coolify | 4.0.0-beta215 | 4.0.0-beta215.x |
| coollabs / coolify | 4.0.0-beta216 | 4.0.0-beta216.x |
| coollabs / coolify | 4.0.0-beta217 | 4.0.0-beta217.x |
| coollabs / coolify | 4.0.0-beta218 | 4.0.0-beta218.x |
| coollabs / coolify | 4.0.0-beta219 | 4.0.0-beta219.x |
| coollabs / coolify | 4.0.0-beta22 | 4.0.0-beta22.x |
| coollabs / coolify | 4.0.0-beta220 | 4.0.0-beta220.x |
| coollabs / coolify | 4.0.0-beta221 | 4.0.0-beta221.x |
| coollabs / coolify | 4.0.0-beta222 | 4.0.0-beta222.x |
| coollabs / coolify | 4.0.0-beta223 | 4.0.0-beta223.x |
| coollabs / coolify | 4.0.0-beta224 | 4.0.0-beta224.x |
| coollabs / coolify | 4.0.0-beta225 | 4.0.0-beta225.x |
| coollabs / coolify | 4.0.0-beta226 | 4.0.0-beta226.x |
| coollabs / coolify | 4.0.0-beta227 | 4.0.0-beta227.x |
| coollabs / coolify | 4.0.0-beta228 | 4.0.0-beta228.x |
| coollabs / coolify | 4.0.0-beta229 | 4.0.0-beta229.x |
| coollabs / coolify | 4.0.0-beta23 | 4.0.0-beta23.x |
| coollabs / coolify | 4.0.0-beta230 | 4.0.0-beta230.x |
| coollabs / coolify | 4.0.0-beta231 | 4.0.0-beta231.x |
| coollabs / coolify | 4.0.0-beta232 | 4.0.0-beta232.x |
| coollabs / coolify | 4.0.0-beta233 | 4.0.0-beta233.x |
| coollabs / coolify | 4.0.0-beta234 | 4.0.0-beta234.x |
| coollabs / coolify | 4.0.0-beta235 | 4.0.0-beta235.x |
| coollabs / coolify | 4.0.0-beta236 | 4.0.0-beta236.x |
| coollabs / coolify | 4.0.0-beta237 | 4.0.0-beta237.x |
| coollabs / coolify | 4.0.0-beta238 | 4.0.0-beta238.x |
| coollabs / coolify | 4.0.0-beta239 | 4.0.0-beta239.x |
| coollabs / coolify | 4.0.0-beta24 | 4.0.0-beta24.x |
| coollabs / coolify | 4.0.0-beta240 | 4.0.0-beta240.x |
| coollabs / coolify | 4.0.0-beta241 | 4.0.0-beta241.x |
| coollabs / coolify | 4.0.0-beta242 | 4.0.0-beta242.x |
| coollabs / coolify | 4.0.0-beta243 | 4.0.0-beta243.x |
| coollabs / coolify | 4.0.0-beta244 | 4.0.0-beta244.x |
| coollabs / coolify | 4.0.0-beta245 | 4.0.0-beta245.x |
| coollabs / coolify | 4.0.0-beta246 | 4.0.0-beta246.x |
| coollabs / coolify | 4.0.0-beta247 | 4.0.0-beta247.x |
| coollabs / coolify | 4.0.0-beta248 | 4.0.0-beta248.x |
| coollabs / coolify | 4.0.0-beta249 | 4.0.0-beta249.x |
| coollabs / coolify | 4.0.0-beta25 | 4.0.0-beta25.x |
| coollabs / coolify | 4.0.0-beta250 | 4.0.0-beta250.x |
| coollabs / coolify | 4.0.0-beta251 | 4.0.0-beta251.x |
| coollabs / coolify | 4.0.0-beta252 | 4.0.0-beta252.x |
| coollabs / coolify | 4.0.0-beta26 | 4.0.0-beta26.x |
| coollabs / coolify | 4.0.0-beta27 | 4.0.0-beta27.x |
| coollabs / coolify | 4.0.0-beta28 | 4.0.0-beta28.x |
| coollabs / coolify | 4.0.0-beta29 | 4.0.0-beta29.x |
| coollabs / coolify | 4.0.0-beta30 | 4.0.0-beta30.x |
| coollabs / coolify | 4.0.0-beta31 | 4.0.0-beta31.x |
| coollabs / coolify | 4.0.0-beta32 | 4.0.0-beta32.x |
| coollabs / coolify | 4.0.0-beta33 | 4.0.0-beta33.x |
| coollabs / coolify | 4.0.0-beta34 | 4.0.0-beta34.x |
| coollabs / coolify | 4.0.0-beta35 | 4.0.0-beta35.x |
| coollabs / coolify | 4.0.0-beta36 | 4.0.0-beta36.x |
| coollabs / coolify | 4.0.0-beta37 | 4.0.0-beta37.x |
| coollabs / coolify | 4.0.0-beta38 | 4.0.0-beta38.x |
| coollabs / coolify | 4.0.0-beta39 | 4.0.0-beta39.x |
| coollabs / coolify | 4.0.0-beta40 | 4.0.0-beta40.x |
| coollabs / coolify | 4.0.0-beta41 | 4.0.0-beta41.x |
| coollabs / coolify | 4.0.0-beta42 | 4.0.0-beta42.x |
| coollabs / coolify | 4.0.0-beta43 | 4.0.0-beta43.x |
| coollabs / coolify | 4.0.0-beta44 | 4.0.0-beta44.x |
| coollabs / coolify | 4.0.0-beta45 | 4.0.0-beta45.x |
| coollabs / coolify | 4.0.0-beta46 | 4.0.0-beta46.x |
| coollabs / coolify | 4.0.0-beta47 | 4.0.0-beta47.x |
| coollabs / coolify | 4.0.0-beta48 | 4.0.0-beta48.x |
| coollabs / coolify | 4.0.0-beta49 | 4.0.0-beta49.x |
| coollabs / coolify | 4.0.0-beta50 | 4.0.0-beta50.x |
| coollabs / coolify | 4.0.0-beta51 | 4.0.0-beta51.x |
| coollabs / coolify | 4.0.0-beta52 | 4.0.0-beta52.x |
| coollabs / coolify | 4.0.0-beta53 | 4.0.0-beta53.x |
| coollabs / coolify | 4.0.0-beta54 | 4.0.0-beta54.x |
| coollabs / coolify | 4.0.0-beta55 | 4.0.0-beta55.x |
| coollabs / coolify | 4.0.0-beta56 | 4.0.0-beta56.x |
| coollabs / coolify | 4.0.0-beta57 | 4.0.0-beta57.x |
| coollabs / coolify | 4.0.0-beta58 | 4.0.0-beta58.x |
| coollabs / coolify | 4.0.0-beta59 | 4.0.0-beta59.x |
| coollabs / coolify | 4.0.0-beta60 | 4.0.0-beta60.x |
| coollabs / coolify | 4.0.0-beta61 | 4.0.0-beta61.x |
| coollabs / coolify | 4.0.0-beta62 | 4.0.0-beta62.x |
| coollabs / coolify | 4.0.0-beta63 | 4.0.0-beta63.x |
| coollabs / coolify | 4.0.0-beta64 | 4.0.0-beta64.x |
| coollabs / coolify | 4.0.0-beta65 | 4.0.0-beta65.x |
| coollabs / coolify | 4.0.0-beta66 | 4.0.0-beta66.x |
| coollabs / coolify | 4.0.0-beta67 | 4.0.0-beta67.x |
| coollabs / coolify | 4.0.0-beta68 | 4.0.0-beta68.x |
| coollabs / coolify | 4.0.0-beta69 | 4.0.0-beta69.x |
| coollabs / coolify | 4.0.0-beta70 | 4.0.0-beta70.x |
| coollabs / coolify | 4.0.0-beta71 | 4.0.0-beta71.x |
| coollabs / coolify | 4.0.0-beta72 | 4.0.0-beta72.x |
| coollabs / coolify | 4.0.0-beta73 | 4.0.0-beta73.x |
| coollabs / coolify | 4.0.0-beta74 | 4.0.0-beta74.x |
| coollabs / coolify | 4.0.0-beta75 | 4.0.0-beta75.x |
| coollabs / coolify | 4.0.0-beta76 | 4.0.0-beta76.x |
| coollabs / coolify | 4.0.0-beta77 | 4.0.0-beta77.x |
| coollabs / coolify | 4.0.0-beta78 | 4.0.0-beta78.x |
| coollabs / coolify | 4.0.0-beta79 | 4.0.0-beta79.x |
| coollabs / coolify | 4.0.0-beta80 | 4.0.0-beta80.x |
| coollabs / coolify | 4.0.0-beta81 | 4.0.0-beta81.x |
| coollabs / coolify | 4.0.0-beta82 | 4.0.0-beta82.x |
| coollabs / coolify | 4.0.0-beta83 | 4.0.0-beta83.x |
| coollabs / coolify | 4.0.0-beta84 | 4.0.0-beta84.x |
| coollabs / coolify | 4.0.0-beta85 | 4.0.0-beta85.x |
| coollabs / coolify | 4.0.0-beta86 | 4.0.0-beta86.x |
| coollabs / coolify | 4.0.0-beta87 | 4.0.0-beta87.x |
| coollabs / coolify | 4.0.0-beta88 | 4.0.0-beta88.x |
| coollabs / coolify | 4.0.0-beta89 | 4.0.0-beta89.x |
| coollabs / coolify | 4.0.0-beta90 | 4.0.0-beta90.x |
| coollabs / coolify | 4.0.0-beta91 | 4.0.0-beta91.x |
| coollabs / coolify | 4.0.0-beta92 | 4.0.0-beta92.x |
| coollabs / coolify | 4.0.0-beta93 | 4.0.0-beta93.x |
| coollabs / coolify | 4.0.0-beta94 | 4.0.0-beta94.x |
| coollabs / coolify | 4.0.0-beta95 | 4.0.0-beta95.x |
| coollabs / coolify | 4.0.0-beta96 | 4.0.0-beta96.x |
| coollabs / coolify | 4.0.0-beta97 | 4.0.0-beta97.x |
| coollabs / coolify | 4.0.0-beta98 | 4.0.0-beta98.x |
| coollabs / coolify | 4.0.0-beta99 | 4.0.0-beta99.x |
- https://github.com/coollabsio/coolify/blob/40a239ddda3fc919f57a052d7b52b8e1a6696b81/bootstrap/helpers/remoteProcess.php#L70
- https://github.com/coollabsio/coolify/commit/353245bb7de9680f238bae30443af1696bc977b0
- https://github.com/coollabsio/coolify/pull/1524
- https://github.com/coollabsio/coolify/pull/1625
- https://github.com/coollabsio/coolify/security/advisories/GHSA-9wqm-fg79-4748
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime