CVE-2025-66213: Coollabs Coolify

High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the File Storage Directory Mount Path functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. The file_storage_directory_source parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. Version 4.0.0-beta.451 fixes the issue.

Affected products

• Coollabs Coolify: before 4.0.0 (fixed in 4.0.0); version 4.0.0 only

Published 2025-12-23. Last modified 2026-06-17.