DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Coolify: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-01-06
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Coolify ausnutzen, um beliebigen Code auszuführen – sogar mit Administratorrechten –, um erweiterte Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder vertrauliche Informationen offenzulegen.
01
beschreibt (16)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-64425US | high8.1 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiat… | ||||
| CVE-2025-64424US | high8.8 | Exploit | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vul… | ||||
| CVE-2025-64423US | high8.8 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (… | ||||
| CVE-2025-64422US | medium4.3 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises… | ||||
| CVE-2025-64421US | high8.0OT erhöht | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (… | ||||
| CVE-2025-64420US | high8.8 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users… | ||||
| CVE-2025-64419US | high8.8 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are… | ||||
| CVE-2025-59955US | medium5.7 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information di… | ||||
| CVE-2025-59158US | high8.0 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a st… | ||||
| CVE-2025-59157US | high8.8 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creat… | ||||
| CVE-2025-59156US | high8.8 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)*vulnerability e… | ||||
| CVE-2025-66213US | high8.8 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerabilit… | ||||
| CVE-2025-66212US | high8.8 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerabilit… | ||||
| CVE-2025-66211US | high8.8 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerabilit… | ||||
| CVE-2025-66210US | high8.8 | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerabilit… | ||||
| CVE-2025-66209US | high8.8 | Exploit | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerabilit… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- GitHub Security Advisory GHSA-234r-xrrg-m8f3 vom 2026-01-06external
- GitHub Security Advisory GHSA-24mp-fc9q-c884 vom 2026-01-06external
- GitHub Security Advisory GHSA-4fqm-797g-7m6j vom 2026-01-06external
- GitHub Security Advisory GHSA-4p6r-m39m-9cm9 vom 2026-01-06external
- GitHub Security Advisory GHSA-5cg9-38qj-8mc3 vom 2026-01-06external
- GitHub Security Advisory GHSA-688j-rm43-5r8x vom 2026-01-06external
- GitHub Security Advisory GHSA-927g-56xp-6427 vom 2026-01-06external
- GitHub Security Advisory GHSA-cj2c-9jx8-j427 vom 2026-01-06external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan