UpHeron
All vulnerabilities

Servers and applications

CVE-2025-22606

Command Injection in Project Name

Severity
High 8.5
Published
24 Jan 2025
Last changed
17 Jun 2026
Added to UpHeron
14 Oct 2026
Also known as
GHSA-ccp8-v65g-m526
Sources
NVD, Project advisories (GitHub)

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes unescaped characters, such as single quotes (`'`), it breaks out of the intended command structure,…

Affected software

SoftwareAffected versions
CoolifyServers and applications · cpe:a:coollabs:coolify
  • Version 4.0.0-beta358
CoolifyServers and applications · github:coollabsio/coolify
  • Version 4.0.0-beta.358

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-22606
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-22606
  • GitHub Advisory Database https://github.com/advisories/GHSA-ccp8-v65g-m526
  • github.com https://github.com/coollabsio/coolify/security/advisories/GHSA-ccp8-v65g-m526