CVE-2025-64424: Coolify Command Injection RCE Vulnerability

CVE-2025-64424 Overview

A critical command injection vulnerability has been identified in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. This vulnerability exists in the git source input fields of a resource, allowing a low-privileged user (member) to execute system commands as root on the Coolify instance. The flaw is classified as CWE-77 (Command Injection).

Critical Impact

A low-privileged user can achieve root-level command execution on the Coolify instance through malicious input in git source fields, potentially leading to complete system compromise.

Affected Products

• Coolify versions up to and including v4.0.0-beta.434

Discovery Timeline

• January 5, 2026 - CVE-2025-64424 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2025-64424

Vulnerability Analysis

This command injection vulnerability (CWE-77) affects Coolify's handling of git source input fields within resource management functionality. The application fails to properly sanitize user-supplied input before passing it to system command execution contexts, creating a dangerous attack surface.

When a user with member-level privileges interacts with the git source configuration for a resource, the application constructs system commands that include the user-provided input. Due to insufficient input validation and sanitization, an attacker can craft malicious input containing shell metacharacters or command separators that escape the intended command context and execute arbitrary commands on the underlying system.

The severity of this vulnerability is significantly amplified by the fact that the commands execute with root privileges. This means that even a user with minimal access rights within the Coolify platform can escalate their privileges to gain complete control over the host system.

Root Cause

The root cause of this vulnerability is improper neutralization of special elements used in command construction. The Coolify application directly incorporates user-supplied git source input into system command strings without adequate sanitization or parameterization. This allows shell metacharacters such as semicolons (;), pipes (|), backticks (`), and command substitution syntax ($(...)) to be interpreted by the shell, breaking out of the intended command context.

Attack Vector

The attack is network-accessible and requires only low-level privileges within the Coolify application. An attacker with member access can navigate to the resource configuration interface and manipulate the git source input fields. By injecting specially crafted payloads containing command injection sequences, the attacker can execute arbitrary commands on the server with root privileges.

The attack requires no user interaction beyond the attacker's own actions and can be performed remotely over the network. The exploitation complexity is low, making this vulnerability particularly dangerous in multi-tenant environments or situations where member access is granted to less-trusted users.

For detailed technical information about this vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-64424

Indicators of Compromise

• Unusual command execution or process spawning from the Coolify application process
• Unexpected shell metacharacters in git source configuration entries (e.g., ;, |, $(), backticks)
• Anomalous root-level processes initiated from web application contexts
• Suspicious modifications to system files or configurations following Coolify resource updates

Detection Strategies

• Implement application-layer logging to capture all git source field inputs and monitor for injection patterns
• Deploy file integrity monitoring on critical system files to detect unauthorized modifications
• Use process monitoring to alert on unexpected child processes spawned by the Coolify application
• Configure SIEM rules to correlate web request patterns with subsequent system command execution

Monitoring Recommendations

• Enable verbose logging within Coolify to track all resource configuration changes
• Monitor system authentication logs for privilege escalation attempts
• Implement network segmentation to limit lateral movement if the Coolify host is compromised
• Review audit logs regularly for member-level users making unusual configuration changes

How to Mitigate CVE-2025-64424

Immediate Actions Required

• Restrict member-level access to only trusted users until a patch is available
• Implement network-level access controls to limit who can reach the Coolify management interface
• Review all existing git source configurations for suspicious or malicious entries
• Consider temporarily disabling git source functionality if operationally feasible

Patch Information

As of the time of publication, it is unclear if a patch is available for this vulnerability. Users should monitor the GitHub Security Advisory for updates on remediation. In the interim, organizations should implement the workarounds and mitigations described below.

Workarounds

• Implement strict access control to ensure only highly trusted users have member-level or higher access to Coolify
• Deploy a web application firewall (WAF) with rules to detect and block command injection patterns in HTTP requests
• Run Coolify in an isolated environment (container or VM) with limited access to critical infrastructure
• Consider using network segmentation to isolate the Coolify instance from sensitive systems

# Example: Restrict network access to Coolify management interface using iptables
# Allow only trusted IP ranges to access the Coolify port
iptables -A INPUT -p tcp --dport 3000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP