High
Coolify Command Injection Vulnerability in Project Name
Type: advisorySources: OSV
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes unescaped characters, such as single quotes (`'`), it breaks out of the intended command structure, allowing attackers to execute arbitrary commands on the host system. This vulnerability allows attackers to execute arbitrary commands on the host server, which could result in full system compromise; create, modify, or delete sensitive system files; and escalate privileges depending on the permissions of the executed process. Attackers with access to project management features could exploit this flaw to gain unauthorized control over the host environment. Version 4.0.0-beta.359 fixes this issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-22606
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 15:00 UTC · Revision 1
Source evidence
Coolify Command Injection Vulnerability in Project Name
core-osv · Original sourcePublished 24 Jan 2025, 15:38 UTC
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes unescaped characters, such as single quotes (`'`), it breaks out of the intended command structure, allowing attackers to execute arbitrary commands on the host system. This vulnerability allows attackers to execute arbitrary commands on the host server, which could result in full system compromise; create, modify, or delete sensitive system files; and escalate privileges depending on the permissions of the executed process. Attackers with access to project management features could exploit this flaw to gain unauthorized control over the host environment. Version 4.0.0-beta.359 fixes this issue.
osv:CVE-2025-22606
Complete source record
{
"id": "6428f8dba62932eebdf98555897a6b9a10160ef7d5bf0c898f7a21577b89b7c6",
"url": "https://osv.dev/vulnerability/CVE-2025-22606",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Coolify Command Injection Vulnerability in Project Name",
"summary": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a \"project,\" it is possible to inject arbitrary shell commands by altering the project name. If a name includes unescaped characters, such as single quotes (`'`), it breaks out of the intended command structure, allowing attackers to execute arbitrary commands on the host system. This vulnerability allows attackers to execute arbitrary commands on the host server, which could result in full system compromise; create, modify, or delete sensitive system files; and escalate privileges depending on the permissions of the executed process. Attackers with access to project management features could exploit this flaw to gain unauthorized control over the host environment. Version 4.0.0-beta.359 fixes this issue.",
"evidence": "osv:CVE-2025-22606",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-22606",
"aliases": [
"CVE-2025-22606",
"GHSA-ccp8-v65g-m526"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/coollabsio/coolify",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ab8851e198c430d721080c77458c3dbd889922d1"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "4.0.0-beta.359"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
}
],
"versions": [
"v4.0.0-beta.358",
"v4.0.0-beta.357",
"v4.0.0-beta.356",
"v4.0.0-beta.355",
"v4.0.0-beta.354",
"v4.0.0-beta.353",
"v4.0.0-beta.350",
"v4.0.0-beta.352",
"v4.0.0-beta.351",
"v4.0.0-beta.349",
"v4.0.0-beta.348",
"v4.0.0-beta.347",
"v4.0.0-beta.346",
"v4.0.0-beta.345",
"v4.0.0-beta.344",
"v4.0.0-beta.343",
"v4.0.0-beta.342",
"v4.0.0-beta.341",
"v4.0.0-beta.340",
"v4.0.0-beta.337",
"v4.0.0-beta.339",
"v4.0.0-beta.338",
"v4.0.0-beta.336",
"v4.0.0-beta.335",
"v4.0.0-beta.334",
"v4.0.0-beta.333",
"v4.0.0-beta.332",
"v4.0.0-beta.331",
"v4.0.0-beta.330",
"v4.0.0-beta.329",
"v4.0.0-beta.328",
"v4.0.0-beta.327",
"v4.0.0-beta.326",
"v4.0.0-beta.325",
"v4.0.0-beta.324",
"v4.0.0-beta.323",
"v4.0.0-beta.319",
"v4.0.0-beta.322",
"v4.0.0-beta.321",
"v4.0.0-beta.320",
"v4.0.0-beta.293",
"v4.0.0-beta.318",
"v4.0.0-beta.317",
"v4.0.0-beta.316",
"v4.0.0-beta.315",
"v4.0.0-beta.314",
"v4.0.0-beta.313",
"v4.0.0-beta.309",
"v4.0.0-beta.312",
"v4.0.0-beta.311",
"v4.0.0-beta.310",
"v4.0.0-beta.308",
"v4.0.0-beta.307",
"v4.0.0-beta.306",
"v4.0.0-beta.305",
"v4.0.0-beta.304",
"v4.0.0-beta.303",
"v4.0.0-beta.302",
"v4.0.0-beta.301",
"v4.0.0-beta.300",
"v4.0.0-beta.299",
"v4.0.0-beta.298",
"v4.0.0-beta.297",
"v4.0.0-beta.296",
"v4.0.0-beta.295",
"v4.0.0-beta.294",
"v4.0.0-beta.292",
"v4.0.0-beta.291",
"v4.0.0-beta.290",
"v4.0.0-beta.289",
"v4.0.0-beta.288",
"v4.0.0-beta.287",
"v4.0.0-beta.286",
"v4.0.0-beta.285",
"v4.0.0-beta.284",
"v4.0.0-beta.283",
"v4.0.0-beta.282",
"v4.0.0-beta.281",
"v4.0.0-beta.280",
"v4.0.0-beta.279",
"v4.0.0-beta.278",
"v4.0.0-beta.277",
"v4.0.0-beta.276",
"v4.0.0-beta.275",
"v4.0.0-beta.274",
"v4.0.0-beta.273",
"v4.0.0-beta.272",
"v4.0.0-beta.271",
"v4.0.0-beta.270",
"v4.0.0-beta.269",
"v4.0.0-beta.268",
"v4.0.0-beta.267",
"v4.0.0-beta.266",
"v4.0.0-beta.265",
"v4.0.0-beta.264",
"v4.0.0-beta.263",
"v4.0.0-beta.262",
"v4.0.0-beta.261",
"v4.0.0-beta.260",
"v4.0.0-beta.259",
"v4.0.0-beta.258",
"v4.0.0-beta.257",
"v4.0.0-beta.256",
"v4.0.0-beta.255",
"v4.0.0-beta.254",
"v4.0.0-beta.253",
"v4.0.0-beta.252",
"v4.0.0-beta.251",
"v4.0.0-beta.249",
"v4.0.0-beta.250",
"v4.0.0-beta.248",
"v4.0.0-beta.247",
"v4.0.0-beta.246",
"v4.0.0-beta.245",
"v4.0.0-beta.244",
"v4.0.0-beta.243",
"v4.0.0-beta.242",
"v4.0.0-beta.241",
"v4.0.0-beta.240",
"v4.0.0-beta.239",
"v4.0.0-beta.238",
"v4.0.0-beta.236",
"v4.0.0-beta.237",
"v4.0.0-beta.235",
"v4.0.0-beta.234",
"v4.0.0-beta.233",
"v4.0.0-beta.232",
"v4.0.0-beta.231",
"v4.0.0-beta.230",
"v4.0.0-beta.229",
"v4.0.0-beta.228",
"v4.0.0-beta.227",
"v4.0.0-beta.226",
"v4.0.0-beta.225",
"v4.0.0-beta.224",
"v4.0.0-beta.223",
"v4.0.0-beta.222",
"v4.0.0-beta.221",
"v4.0.0-beta.220",
"v4.0.0-beta.219",
"v4.0.0-beta.218",
"v4.0.0-beta.217",
"v4.0.0-beta.216",
"v4.0.0-beta.215",
"v4.0.0-beta.214",
"v4.0.0-beta.213",
"v4.0.0-beta.212",
"v4.0.0-beta.211",
"v4.0.0-beta.209",
"v4.0.0-beta.208",
"v4.0.0-beta.207",
"v4.0.0-beta.206",
"v4.0.0-beta.205",
"v4.0.0-beta.204",
"v4.0.0-beta.203",
"v4.0.0-beta.202",
"v4.0.0-beta.201",
"v4.0.0-beta.200",
"v4.0.0-beta.199",
"v4.0.0-beta.198",
"v4.0.0-beta.197",
"v4.0.0-beta.196",
"v4.0.0-beta.195",
"v4.0.0-beta.194",
"v4.0.0-beta.193",
"v4.0.0-beta.192",
"v4.0.0-beta.191",
"v4.0.0-beta.190",
"v4.0.0-beta.189",
"v4.0.0-beta.188",
"v4.0.0-beta.187",
"v4.0.0-beta.186",
"v4.0.0-beta.185",
"v4.0.0-beta.184",
"v4.0.0-beta.183",
"v4.0.0-beta.182",
"v4.0.0-beta.181",
"v4.0.0-beta.180",
"v4.0.0-beta.179",
"v4.0.0-beta.178",
"v4.0.0-beta.177",
"v4.0.0-beta.176",
"v4.0.0-beta.175",
"v4.0.0-beta.174",
"v4.0.0-beta.173",
"v4.0.0-beta.172",
"v4.0.0-beta.171",
"v4.0.0-beta.170",
"v4.0.0-beta.169",
"v4.0.0-beta.168",
"v4.0.0-beta.167",
"v4.0.0-beta.166",
"v4.0.0-beta.165",
"v4.0.0-beta.164",
"v4.0.0-beta.163",
"v4.0.0-beta.162",
"v4.0.0-beta.161",
"v4.0.0-beta.160",
"v4.0.0-beta.159",
"v4.0.0-beta.158",
"v4.0.0-beta.157",
"v4.0.0-beta.156",
"v4.0.0-beta.155",
"v4.0.0-beta.154",
"v4.0.0-beta.153",
"v4.0.0-beta.152",
"v4.0.0-beta.151",
"v4.0.0-beta.150",
"v4.0.0-beta.149",
"v4.0.0-beta.148",
"v4.0.0-beta.147",
"v4.0.0-beta.146",
"v4.0.0-beta.145",
"v4.0.0-beta.144",
"v4.0.0-beta.143",
"v4.0.0-beta.142",
"v4.0.0-beta.141",
"v4.0.0-beta.140",
"v4.0.0-beta.139",
"v4.0.0-beta.138",
"v4.0.0-beta.137",
"v4.0.0-beta.136",
"v4.0.0-beta.135",
"v4.0.0-beta.134",
"v4.0.0-beta.133",
"v4.0.0-beta.132",
"v4.0.0-beta.131",
"v4.0.0-beta.130",
"v4.0.0-beta.129",
"v4.0.0-beta.128",
"v4.0.0-beta.127",
"v4.0.0-beta.126",
"v4.0.0-beta.125",
"v4.0.0-beta.124",
"v4.0.0-beta.123",
"v4.0.0-beta.122",
"v4.0.0-beta.121",
"v4.0.0-beta.120",
"v4.0.0-beta.119",
"v4.0.0-beta.118",
"v4.0.0-beta.117",
"v4.0.0-beta.116",
"v4.0.0-beta.115",
"v4.0.0-beta.114",
"v4.0.0-beta.113",
"v4.0.0-beta.112",
"v4.0.0-beta.111",
"v4.0.0-beta.110",
"v4.0.0-beta.109",
"v4.0.0-beta.108",
"v4.0.0-beta.107",
"v4.0.0-beta.106",
"v4.0.0-beta.105",
"v4.0.0-beta.104",
"v4.0.0-beta.103",
"v4.0.0-beta.102",
"v4.0.0-beta.101",
"v4.0.0-beta.100",
"v4.0.0-beta.99",
"v4.0.0-beta.98",
"v4.0.0-beta.97",
"v4.0.0-beta.96",
"v4.0.0-beta.95",
"v4.0.0-beta.94",
"v4.0.0-beta.93",
"v4.0.0-beta.92",
"v4.0.0-beta.91",
"v4.0.0-beta.90",
"v4.0.0-beta.89",
"v4.0.0-beta.88",
"v4.0.0-beta.87",
"v4.0.0-beta.86",
"v4.0.0-beta.85",
"v4.0.0-beta.84",
"v4.0.0-beta.83",
"v4.0.0-beta.82",
"v4.0.0-beta.81",
"v4.0.0-beta.80",
"v4.0.0-beta.79",
"v4.0.0-beta.78",
"v4.0.0-beta.77",
"v4.0.0-beta.76",
"v4.0.0-beta.75",
"v4.0.0-beta.74",
"v4.0.0-beta.73",
"v4.0.0-beta.72",
"v4.0.0-beta.71",
"v4.0.0-beta.70",
"v4.0.0-beta.69",
"v4.0.0-beta.68",
"v4.0.0-beta.67",
"v4.0.0-beta.66",
"v4.0.0-beta.65",
"v4.0.0-beta.64",
"v4.0.0-beta.63",
"v4.0.0-beta.62",
"v4.0.0-beta.61",
"v4.0.0-beta.60",
"v4.0.0-beta.59",
"v4.0.0-beta.58",
"v4.0.0-beta.57",
"v4.0.0-beta.56",
"v4.0.0-beta.55",
"v4.0.0-beta.54",
"v4.0.0-beta.53",
"v4.0.0-beta.52",
"v4.0.0-beta.51",
"v4.0.0-beta.50",
"v4.0.0-beta.49",
"v4.0.0-beta.48",
"v4.0.0-beta.47",
"v4.0.0-beta.46",
"v4.0.0-beta.45",
"v4.0.0-beta.44",
"v4.0.0-beta.43",
"v4.0.0-beta.42",
"v4.0.0-beta.41",
"4.0.0-beta.40",
"4.0.0-beta.39",
"v4.0.0-beta.38",
"v4.0.0-beta.37",
"v4.0.0-beta.36",
"v4.0.0-beta.35",
"v4.0.0-beta.34",
"v4.0.0-beta.33",
"v4.0.0-beta.32",
"v4.0.0-beta.31",
"v4.0.0-beta.30",
"v4.0.0-beta.29",
"v4.0.0-beta.28",
"v4.0.0-beta.27",
"v4.0.0-beta.26",
"v4.0.0-beta.25",
"v4.0.0-beta.24",
"v4.0.0-beta.23",
"v4.0.0-beta.22",
"v4.0.0-beta.21",
"v4.0.0-beta.20",
"v4.0.0-beta.19",
"v4.0.0-beta.18",
"v3.12.28",
"v3.12.27",
"v3.12.26",
"v3.12.25",
"v3.12.24",
"v3.12.23",
"v3.12.22",
"v3.12.21",
"v3.12.20",
"v3.12.19",
"v3.12.18",
"v3.12.17",
"v3.12.16",
"v3.12.15",
"v3.12.14",
"v3.12.13",
"v3.12.12",
"v3.12.11",
"v3.12.10",
"v3.12.8",
"v3.12.9",
"v3.12.7",
"v3.12.6",
"v3.12.5",
"v3.12.4",
"v3.12.3",
"v3.12.2",
"v3.12.1",
"v3.12.0",
"v3.11.13",
"v3.11.12",
"v3.11.11",
"v3.11.10",
"v3.11.9",
"v3.11.8",
"v3.11.7",
"v3.11.6",
"v3.11.5",
"v3.11.4",
"v3.11.2",
"v3.11.3",
"v3.11.1",
"v3.11.0",
"v3.10.16",
"v3.10.15",
"v3.10.14",
"v3.10.13",
"v3.10.12",
"v3.10.11",
"v3.10.10",
"v3.10.9",
"v3.10.8",
"v3.10.7",
"v3.10.6",
"v3.10.5",
"v3.10.4",
"v3.10.3",
"v3.10.2",
"v3.10.1",
"v3.10.0",
"v3.9.4",
"v3.9.3",
"v3.9.2",
"v3.9.1",
"v3.9.0",
"v3.8.9",
"v3.8.8",
"v3.8.7",
"v3.8.6",
"v3.8.5",
"v3.8.4",
"v3.8.3",
"v3.8.2",
"v3.8.1",
"v3.8.0",
"v3.7.0",
"v3.6.0",
"v3.5.2",
"v3.5.1",
"v3.5.0",
"v3.4.0",
"v3.3.4",
"v3.3.2",
"v3.3.3",
"v3.3.1",
"v3.3.0",
"v3.2.3",
"v3.2.2",
"v3.2.1",
"v3.2.0",
"v3.1.4",
"v3.1.3",
"v3.1.2",
"v3.1.1",
"v3.1.0",
"v3.0.3",
"v3.0.2",
"v3.0.1",
"v3.0.0",
"v2.9.11",
"v2.9.10",
"v2.9.9",
"v2.9.8",
"v2.9.7",
"v2.9.6",
"v2.9.5",
"v2.9.4",
"v2.9.3",
"v2.9.2",
"v2.9.1",
"v2.9.0",
"v2.8.2",
"v2.8.1",
"v2.8.0",
"v2.7.0",
"v2.6.3",
"v2.6.2",
"v2.6.1",
"v2.6.0",
"v2.5.2",
"v2.5.1",
"v2.5.0",
"v2.4.11",
"v2.4.10",
"v2.4.9",
"v2.4.8",
"v2.4.7",
"v2.4.6",
"v2.4.5",
"v2.4.4",
"v2.4.2",
"v2.4.1",
"v2.4.0",
"v2.3.3",
"v2.3.2",
"v2.3.1",
"v2.3.0",
"v2.2.7",
"v2.2.6",
"v2.2.5",
"v2.2.4",
"v2.2.3",
"v2.2.0",
"v2.1.1",
"v2.1.0",
"v2.0.32",
"v2.0.31",
"v2.0.30",
"v2.0.29",
"v2.0.28",
"v2.0.27",
"v2.0.26",
"v2.0.25",
"v2.0.24",
"v2.0.23",
"v2.0.22",
"v2.0.21",
"v2.0.20",
"v2.0.19",
"v2.0.18",
"v2.0.17",
"v2.0.16",
"v2.0.13",
"v2.0.15",
"v2.0.14",
"v2.0.12",
"v2.0.11",
"v2.0.10",
"v2.0.8",
"v2.0.7",
"v2.0.6",
"v2.0.5",
"v2.0.4",
"v2.0.3",
"v2.0.2",
"v2.0.0",
"v1.0.24",
"v1.0.23",
"v1.0.22",
"v1.0.21",
"v1.0.20",
"v1.0.19",
"v1.0.18",
"v1.0.17",
"v1.0.16",
"v1.0.15",
"v1.0.14",
"v1.0.13",
"v1.0.12",
"v1.0.11",
"v1.0.10",
"v1.0.9",
"v1.0.8",
"v1.0.7",
"v1.0.6",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.1",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22606.json"
}
}
],
"modified": "2026-10-28T02:30:29.922406523Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22606.json",
"https://github.com/coollabsio/coolify/security/advisories/GHSA-ccp8-v65g-m526",
"https://nvd.nist.gov/vuln/detail/CVE-2025-22606"
],
"provider_metadata": {
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22606.json"
}
},
"related_cves": [
{
"value": "CVE-2025-22606",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 496624,
"published_at": "2025-01-24T15:38:47.352+00:00"
}