CVE-2025-34159criticalCWE-20CWE-94

CVE-2025-34159: falha crítica em coolLabs Technologies Coolify

Coolify Docker Compose Directive Injection in Application Deployment Workflow

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Coolify

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 1.0%
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can gain full root access to the underlying server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
coolLabs Technologies · Coolify
CVEs relacionadas — coolLabs Technologies Coolify

No mesmo produto, das mais perigosas para as menos.

CVE-2025-34161CRITICALCoolify Git Repository Field Command Injection in Project Deployment WorkflowEPSS 3.0%CVE-2025-34157CRITICALCoolify Stored Cross-Site Scripting (XSS) in Project Name FieldEPSS 0.5%