CVE-2025-34161

Coolify Git Repository Field Command Injection in Project Deployment Workflow

State: Published
Severity: 9.4 Critical
Published: Aug 27, 2025
Updated: Jul 14, 2026
Reserved: Apr 15, 2025

Description

Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, resulting in full server compromise.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-20 Improper Input Validation

Affected Products

Product	Versions
CoolifycoolLabs Technologies	before 4.0.0-beta.420.7Affected

References

https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7vendor-advisorypatch
https://coolify.io/product
https://github.com/Eyodav/CVE-2025-34161technical-descriptionexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.