CVE-2025-64424

Coolify is an open-source tool for managing servers, applications, and databases. In versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim and modify the Host header to a malicious value. The victim receives a password reset email with a link to the malicious host, and if clicked, the reset token is sent to the attacker's server, allowing account takeover.

Coolify is an open-source tool for managing servers, applications, and databases. In versions up to and including v4.0.0-beta.434, a low-privileged user (member) can view and use invitation links sent to an administrator. If they use the link before the legitimate recipient, they can log in as an administrator, resulting in privilege escalation.

Coolify up to version v4.0.0-beta.434 contains a vulnerability that allows a low-privileged user (member) to invite a high-privileged user (administrator). Although the first invitation attempt fails with an error, clicking the invite button a second time succeeds. This enables an attacker to invite themselves as an administrator, then reset the password and log in with admin privileges.

Coolify versions up to and including v4.0.0-beta.420.6 are vulnerable to a stored XSS attack in the project creation workflow. An authenticated low-privileged user can create a project with a malicious name containing JavaScript, which executes in the admin's browser when the project or resource is deleted. Version 4.0.0-beta.420.7 contains a patch.

Coolify before version 4.0.0-beta.420.7 contains a Remote Code Execution (RCE) vulnerability in the application deployment workflow. A low-privileged member can inject arbitrary Docker Compose directives during project creation or updates, allowing to mount the host filesystem and execute commands with root privileges, bypassing container isolation.

In Coolify prior to version 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization. This allows a low-privileged team member to connect to terminal routes and execute commands on team servers.

In Coolify prior to version 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands.

Coolify prior to version 4.0.0-beta.464 has a vulnerability in the cloneTo() Livewire action in ResourceOperations.php. The authorization only checks the source resource, but destination resources are resolved using unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources.

Coolify prior to version 4.0.0-beta.469 contains an authenticated remote command injection vulnerability in application deployment handling. An authenticated user with application write permissions can exploit fields like dockerfile_location and deployment commands to achieve remote code execution and exfiltrate sensitive environment variables through deployment logs.

Coolify prior to version 4.0.0-beta.474 has a vulnerability where Livewire web UI components accept server_id and destination_uuid from URL query parameters without team ownership validation. This allows cross-team resource deployment on servers belonging to other teams.