CVE-2025-66209

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

• CWE-78

• https://github.com/0xrakan/coolify-cve-2025-66209-66213Exploit, Third Party Advisory
• https://github.com/coollabsio/coolify/pull/7375Issue Tracking, Patch
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451Release Notes
• https://github.com/coollabsio/coolify/security/advisories/GHSA-vm5p-43qh-7pmqExploit, Vendor Advisory
• https://github.com/coollabsio/coolify/security/advisories/GHSA-vm5p-43qh-7pmqExploit, Vendor Advisory

Published

Dec 23, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66202Astro is a web framework. Versions 5.15.7 and below have a d…6.5
• CVE-2025-66203StreamVault is a video download integration solution. Prior …9.1
• CVE-2025-66204WBCE CMS is a content management system. Version 1.6.4 conta…8.1
• CVE-2025-66205Frappe is a full-stack web application framework. Prior to 1…9.8
• CVE-2025-66206Frappe is a full-stack web application framework. Prior to 1…8.6
• CVE-2025-66208Collabora Online - Built-in CODE Server (richdocumentscode) …9.8
• CVE-2025-6621A vulnerability classified as critical has been found in TOT…9.8
• CVE-2025-66210Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-66211Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-66212Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-66213Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-66214Ladybug adds message-based debugging, unit, system, and regr…8.8