coolLabs Coolify 4.0.0 Beta 402
Approved changes feed: RSS · Atom
cpe:2.3:a:coollabs:coolify:4.0.0:beta402:*:*:*:*:*:*part: a version: 4.0.0 update: beta402
| Vendor | Coollabs (2db86037-d494-5a4e-9ad7-2bb6ad0430a3) |
|---|---|
| Product | Coolify (286a4912-a4d8-57ce-8ca8-3ea4b537a93c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/coollabsio/coolify |
purl2cpe | 2026-06-01 10:15:00.962527 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-66213 |
vulnerable | 2026-06-08 07:39:21.698155 |
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the File Storage Directory Mount Path functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. The file_storage_directory_source parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. Version 4.0.0-beta.451 fixes the issue.
Published: 2025-12-23T22:06:38.995Z
Updated: 2026-03-17T16:16:15.316Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66212 |
vulnerable | 2026-06-08 07:39:21.658843 |
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Dynamic Proxy Configuration Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Proxy configuration filenames are passed to shell commands without proper escaping, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
Published: 2025-12-23T22:04:18.883Z
Updated: 2026-03-17T16:16:59.807Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66211 |
vulnerable | 2026-06-08 07:39:21.622149 |
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
Published: 2025-12-23T22:00:36.081Z
Updated: 2026-03-17T16:18:26.310Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66210 |
vulnerable | 2026-06-08 07:39:21.593439 |
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Import functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in import operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
Published: 2025-12-23T21:49:44.710Z
Updated: 2026-03-17T16:20:29.084Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66209 |
vulnerable | 2026-06-08 07:39:21.516544 |
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup
CRITICAL (10)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
Published: 2025-12-23T21:42:18.324Z
Updated: 2026-03-17T16:21:52.380Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64425 |
vulnerable | 2026-06-08 07:39:19.129508 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64424 |
vulnerable | 2026-06-08 07:39:19.091348 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64423 |
vulnerable | 2026-06-08 07:39:19.041787 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64422 |
vulnerable | 2026-06-08 07:39:18.998405 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64421 |
vulnerable | 2026-06-08 07:39:18.945961 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64420 |
vulnerable | 2026-06-08 07:39:18.906542 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64419 |
vulnerable | 2026-06-08 07:39:18.771273 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59158 |
vulnerable | 2026-06-08 07:35:20.504678 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59157 |
vulnerable | 2026-06-08 07:35:20.464395 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59156 |
vulnerable | 2026-06-08 07:35:20.358474 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34161 |
vulnerable | 2026-06-08 07:19:02.682674 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34159 |
vulnerable | 2026-06-08 07:19:02.608555 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34157 |
vulnerable | 2026-06-08 07:19:02.523918 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.