coollabsio coolify up to 4.0.0-beta.450 File Storage Directory Mount file_storage_directory_source os command injection

Summaryinfo

A vulnerability was found in coollabsio coolify up to 4.0.0-beta.450. It has been rated as critical. Affected is an unknown function of the component File Storage Directory Mount Handler. This manipulation of the argument file_storage_directory_source causes os command injection. This vulnerability is tracked as CVE-2025-66213. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in coollabsio coolify up to 4.0.0-beta.450. Affected by this vulnerability is an unknown function of the component File Storage Directory Mount Handler. The manipulation of the argument file_storage_directory_source with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the File Storage Directory Mount Path functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. The file_storage_directory_source parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. Version 4.0.0-beta.451 fixes the issue.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-66213 since 11/25/2025. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading to version 4.0.0-beta.451 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• coollabsio

Name

• coolify

Version

• 4.0.0-beta.450

Website

• Product: https://github.com/coollabsio/coolify/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion