CVE WatchJul 14, 2026

CVE-2025-34161

Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The

CVSS

8.8

High

EPSS

3.7%

p88

KEV

—

Exploit Today

0-100

Published: Aug 27, 2025 · Last modified: Jul 14, 2026 · CWE-20 · CWE-78

EPSS · 30d

3.7%EPSS · 30 days3.7%

2026-06-302026-07-16

Technical description

Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, resulting in full server compromise.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability2d CVE-2024-121210.0 CRI

99.9%

KEV—80Progress Kemp LoadMaster OS Command Injection Vulnerability3d CVE-2022-262589.8 CRI

99.6%

KEV—80D-Link DIR-820L Remote Code Execution Vulnerability7d CVE-2026-422718.8 HIG

99.6%

KEV—80BerriAI LiteLLM Command Injection Vulnerability2d CVE-2021-252988.8 HIG

99.5%

KEV—80Nagios XI OS Command Injection7d CVE-2021-252978.8 HIG

98.9%

KEV—80Nagios XI OS Command Injection7d