# CVE-2025-34159: Coolabs Coolify remote code execution via Docker Compose injection

Source: https://junglewise.ai/threats/cve-2025-34159-coolabs-coolify-remote-code-execution-via-docker-compose  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-27. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2025-34159 · Severity: high · CVSS 8.8 · Published 2025-08-27

Coolify, an open-source platform for deploying web applications and databases, contains a vulnerability that allows users with low-level permissions to take full control of the underlying server. By providing a specially crafted configuration during the application deployment process, an attacker can bypass security restrictions and access the server's root filesystem. This could lead to a complete compromise of the server, including the theft of sensitive data and the disruption of all hosted services.

## Quick answers

**Is CVE-2025-34159 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-34159 being exploited in the wild.

**How severe is CVE-2025-34159?** High severity, with a CVSS score of 8.8, published 27 August 2025.

**Which products and versions are affected?** coollabsio Coolify up to and including v4.0.0-beta.420.6.

**Is there a fix for CVE-2025-34159?** A patch was published on 2025-08-26: Version v4.0.0-beta.420.7 released with security fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-34159 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-34159?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A remote code execution (RCE) vulnerability exists in Coolify's application deployment workflow due to improper input validation of Docker Compose directives. Authenticated users with 'member' level privileges can inject arbitrary directives during project creation or updates. Specifically, an attacker can define a malicious service that mounts the host's root filesystem (e.g., using volume mounts like '/:/host') and execute commands via the 'command' directive to achieve root-level execution on the host OS. This bypasses container isolation and UI-based terminal restrictions. The vulnerability is addressed in version v4.0.0-beta.420.7.

## Affected products

- coollabsio Coolify up to and including v4.0.0-beta.420.6

## Timeline

- 2025-08-26: patched: Version v4.0.0-beta.420.7 released with security fixes.
- 2025-08-27: advisory: CVE-2025-34159 published.

## References

- [https://coolify.io/](https://coolify.io/)
- [https://github.com/Eyodav/CVE-2025-34159](https://github.com/Eyodav/CVE-2025-34159)
- [https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7](https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7)