# CVE-2025-66211: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version…

Source: https://junglewise.ai/threats/cve-2025-66211-coolify-is-an-open-source-and-self-hostable-tool-for-managing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-23  
License: CC BY 4.0 with a link back

CVE-2025-66211 · Severity: high · CVSS 8.8 · Published 2025-12-23

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Technologies: [Coollabs Coolify](https://junglewise.ai/threats/technologies/coolify). Vendors: [Coollabs](https://junglewise.ai/threats/vendors/coollabs).

## Quick answers

**Is CVE-2025-66211 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66211 being exploited in the wild.

**How severe is CVE-2025-66211?** High severity, with a CVSS score of 8.8, published 23 December 2025.

**Which products and versions are affected?** Coollabs Coolify. The advisory does not name versions.

**Is there a fix for CVE-2025-66211?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-66211?** Check whether you run Coollabs Coolify. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Coollabs Coolify

## Related threats

- [Coolify information disclosure via webhook enumeration](https://junglewise.ai/threats/cve-2026-121587-coolify-before-4-1-1-contains-an-information-disclosure)
- [Coollabsio Coolify path traversal in PostgreSQL init scripts](https://junglewise.ai/threats/cve-2026-42200-coollabsio-coolify-path-traversal-in-postgresql-init-scripts)
- [Coollabs Coolify insufficient session expiration for API tokens](https://junglewise.ai/threats/cve-2026-42172-coollabs-coolify-insufficient-session-expiration-for-api-tokens)
- [Coollabsio Coolify SSRF in S3 storage endpoint validation](https://junglewise.ai/threats/cve-2026-42147-coollabsio-coolify-ssrf-in-s3-storage-endpoint-validation)
- [Coolify account takeover via CSRF in invitation endpoint](https://junglewise.ai/threats/cve-2026-34171-coolify-account-takeover-via-csrf-in-invitation-endpoint)