Executive brief
Coolify, an open-source platform for deploying web applications and databases, contains a vulnerability that allows users with low-level permissions to take full control of the underlying server. By providing a specially crafted configuration during the application deployment process, an attacker can bypass security restrictions and access the server's root filesystem. This could lead to a complete compromise of the server, including the theft of sensitive data and the disruption of all hosted services.
Technical details
A remote code execution (RCE) vulnerability exists in Coolify's application deployment workflow due to improper input validation of Docker Compose directives. Authenticated users with 'member' level privileges can inject arbitrary directives during project creation or updates. Specifically, an attacker can define a malicious service that mounts the host's root filesystem (e.g., using volume mounts like '/:/host') and execute commands via the 'command' directive to achieve root-level execution on the host OS. This bypasses container isolation and UI-based terminal restrictions. The vulnerability is addressed in version v4.0.0-beta.420.7.
Affected products
- coollabsio Coolify up to and including v4.0.0-beta.420.6
Timeline
- 2025-08-26: patched: Version v4.0.0-beta.420.7 released with security fixes.
- 2025-08-27: advisory: CVE-2025-34159 published.