CVE-2025-22606: Coollabs Coolify RCE Vulnerability

CVE-2025-22606 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2025-22606 is a command injection vulnerability [CWE-78] in Coolify version 4.0.0-beta.358 and possibly earlier releases. When a user creates or updates a project, the project name value is passed to a shell context without proper escaping. Attackers with access to project management features can inject shell metacharacters such as single quotes to break out of the intended command structure. Successful exploitation results in arbitrary command execution on the host server. Coolify version 4.0.0-beta.359 addresses the issue.

Critical Impact
Authenticated attackers with project management access can execute arbitrary shell commands on the Coolify host, leading to full system compromise, file tampering, and potential privilege escalation.

Affected Products

Coollabs Coolify 4.0.0-beta.358
Coolify releases prior to 4.0.0-beta.358 that share the same project handling logic
Self-hosted Coolify deployments exposing project management features to authenticated users

Discovery Timeline

2025-01-24 - CVE-2025-22606 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22606

Vulnerability Analysis

Coolify constructs shell commands that incorporate the user-supplied project name during creation and update operations. The application does not escape or sanitize special shell characters before assembling these commands. An attacker who submits a project name containing a single quote ('), backtick, semicolon, or command substitution syntax can terminate the intended argument and append arbitrary commands.

The injected payload executes with the privileges of the Coolify service process on the host. Because Coolify orchestrates containers, servers, and databases, that process typically holds broad access to Docker sockets, deployment scripts, and stored credentials. This transforms a single injected payload into a path toward full host compromise, credential theft, and lateral movement into managed workloads.

Root Cause

The root cause is improper neutralization of special elements used in an operating system command [CWE-78]. Project name input is concatenated directly into shell command strings rather than passed as an isolated argument array. No allowlist, escaping routine, or parameterized execution API is applied before invocation.

Attack Vector

Exploitation requires local or authenticated access to the Coolify web interface with permissions to create or edit projects. The attacker submits a crafted project name containing shell metacharacters. When Coolify processes the project, the injected commands run on the underlying host. See the GitHub Security Advisory GHSA-ccp8-v65g-m526 for maintainer details on the affected code path.

Exploitation pattern (conceptual, no verified PoC published):
Project name field --> "legit'; <injected shell command>; #"
Coolify shell invocation --> sh -c "... 'legit'; <injected shell command>; #' ..."
Result --> injected command executes with Coolify service privileges

Detection Methods for CVE-2025-22606

Indicators of Compromise

Project names in the Coolify database containing shell metacharacters such as ', `, ;, &&, |, or $( )
Unexpected child processes spawned by the Coolify service, especially sh, bash, curl, wget, or nc
Outbound network connections from the Coolify host to unknown IPs shortly after project create or update actions
New or modified files in service directories, cron paths, or SSH authorized_keys on the Coolify host

Detection Strategies

Audit Coolify application logs and database entries for project names containing non-alphanumeric characters beyond expected punctuation.
Correlate project create/update HTTP requests with process execution telemetry on the host to identify command spawns tied to those requests.
Alert on Coolify process trees invoking shell interpreters with argument strings that contain quoting or command chaining syntax.

Monitoring Recommendations

Enable process and command-line auditing on Coolify hosts using auditd or equivalent to capture arguments passed to sh -c invocations.
Ship Coolify application logs and host process telemetry to a centralized analytics platform for correlation across create, update, and deployment events.
Track outbound connections from the Coolify host and flag any not associated with known Git, registry, or deployment endpoints.

How to Mitigate CVE-2025-22606

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.359 or later on all self-hosted instances.
Restrict project management privileges to trusted administrators until the upgrade is verified in production.
Review existing projects for names containing shell metacharacters and rename or remove suspicious entries.
Rotate credentials, API tokens, and SSH keys accessible to the Coolify service if exploitation is suspected.

Patch Information

Coollabs released the fix in Coolify 4.0.0-beta.359. The maintainer advisory is published at GHSA-ccp8-v65g-m526. Operators running self-hosted deployments should update container images or source builds to this version or a later release that contains the fix.

Workarounds

Place the Coolify web interface behind a VPN or reverse proxy with strict authentication to reduce the attacker pool.
Remove or downgrade project create and update permissions for non-administrator accounts until the patch is applied.
Run Coolify as an unprivileged user with the minimum host access required, limiting the impact of any injected command.

bash

# Upgrade a self-hosted Coolify deployment to the patched release
cd /data/coolify
git fetch --tags
git checkout v4.0.0-beta.359
docker compose pull
docker compose up -d

# Verify the running version
docker exec coolify sh -c 'cat /var/www/html/versions.json | grep -i version'