https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-64425.htmlhttps://patchthecve.com/cve/CVE-2025-64425.htmlWed, 07 Oct 2026 10:10:00 +0000HIGH 8.1: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim, and modify the host header of the request to a malicious value. The victim will receivehttps://patchthecve.com/cve/CVE-2025-64424.htmlhttps://patchthecve.com/cve/CVE-2025-64424.htmlWed, 07 Oct 2026 10:10:00 +0000HIGH 8.8: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user (member) to execute systehttps://patchthecve.com/cve/CVE-2025-64423.htmlhttps://patchthecve.com/cve/CVE-2025-64423.htmlWed, 07 Oct 2026 10:10:00 +0000HIGH 8.8: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can see and use invitation links sent to an administrator. When they use the link before the legitimate recipienhttps://patchthecve.com/cve/CVE-2025-64422.htmlhttps://patchthecve.com/cve/CVE-2025-64422.htmlWed, 07 Oct 2026 10:10:00 +0000MEDIUM 4.3: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. This enables unlimitedhttps://patchthecve.com/cve/CVE-2025-64421.htmlhttps://patchthecve.com/cve/CVE-2025-64421.htmlWed, 07 Oct 2026 10:10:00 +0000HIGH 8.0: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can invite a high privileged user. At first, the application will throw an error, but if the attacker clicks thehttps://patchthecve.com/cve/CVE-2025-64420.htmlhttps://patchthecve.com/cve/CVE-2025-64420.htmlWed, 07 Oct 2026 10:10:00 +0000CRITICAL 9.9: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authttps://patchthecve.com/cve/CVE-2025-64419.htmlhttps://patchthecve.com/cve/CVE-2025-64419.htmlWed, 07 Oct 2026 10:10:00 +0000CRITICAL 9.6: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pahttps://patchthecve.com/cve/CVE-2025-59955.htmlhttps://patchthecve.com/cve/CVE-2025-59955.htmlWed, 07 Oct 2026 10:10:00 +0000MEDIUM 5.7: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/teams/current/members` API endpoints allowshttps://patchthecve.com/cve/CVE-2025-59158.htmlhttps://patchthecve.com/cve/CVE-2025-59158.htmlWed, 07 Oct 2026 10:10:00 +0000HIGH 8.0: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges (e.g.https://patchthecve.com/cve/CVE-2025-59157.htmlhttps://patchthecve.com/cve/CVE-2025-59157.htmlWed, 07 Oct 2026 10:10:00 +0000CRITICAL 9.9: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creation is vulnerable to command injection. User input is not properly sanitized, allowing attackers to inject arbitrary shehttps://patchthecve.com/cve/CVE-2025-59156.htmlhttps://patchthecve.com/cve/CVE-2025-59156.htmlWed, 07 Oct 2026 10:10:00 +0000HIGH 8.8: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)*vulnerability exists in Coolify's application deployment workflow. This flaw allows a low-privileged member to inject arbitrary Docker https://patchthecve.com/cve/CVE-2025-66213.htmlhttps://patchthecve.com/cve/CVE-2025-66213.htmlMon, 19 Oct 2026 22:10:00 +0000HIGH 8.8: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the File Storage Directory Mount Path functionality allows users with application/service management permissions tohttps://patchthecve.com/cve/CVE-2025-66212.htmlhttps://patchthecve.com/cve/CVE-2025-66212.htmlMon, 19 Oct 2026 22:10:00 +0000HIGH 8.8: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Dynamic Proxy Configuration Filename handling allows users with application/service management permissions to ehttps://patchthecve.com/cve/CVE-2025-66211.htmlhttps://patchthecve.com/cve/CVE-2025-66211.htmlMon, 19 Oct 2026 22:10:00 +0000HIGH 8.8: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/service management permissions to execute arhttps://patchthecve.com/cve/CVE-2025-66210.htmlhttps://patchthecve.com/cve/CVE-2025-66210.htmlMon, 19 Oct 2026 22:10:00 +0000HIGH 8.8: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Import functionality allows users with application/service management permissions to execute arbitraryhttps://patchthecve.com/cve/CVE-2025-66209.htmlhttps://patchthecve.com/cve/CVE-2025-66209.htmlMon, 19 Oct 2026 22:10:00 +0000CRITICAL 9.9: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitraryhttps://patchthecve.com/cve/CVE-2025-34161.htmlhttps://patchthecve.com/cve/CVE-2025-34161.htmlTue, 14 Jul 2026 23:17:21 +0000HIGH 8.8: Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. https://patchthecve.com/cve/CVE-2025-34159.htmlhttps://patchthecve.com/cve/CVE-2025-34159.htmlTue, 14 Jul 2026 23:17:20 +0000HIGH 8.8: Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a https://patchthecve.com/cve/CVE-2025-34157.htmlhttps://patchthecve.com/cve/CVE-2025-34157.htmlTue, 14 Jul 2026 23:17:20 +0000CRITICAL 9.0: Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to https://patchthecve.com/cve/CVE-2025-24025.htmlhttps://patchthecve.com/cve/CVE-2025-24025.htmlWed, 17 Jun 2026 08:57:54 +0000MEDIUM 6.1: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users to search for tags. If the search does not return any results, the query gets reflected on the error modal, which leads to cross-site scripthttps://patchthecve.com/cve/CVE-2025-22612.htmlhttps://patchthecve.com/cve/CVE-2025-22612.htmlWed, 17 Jun 2026 08:48:42 +0000CRITICAL 10.0: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization allows an authenticated user to retrieve any existing private keys on a coolify instance in plain text. If the server configuration of IP / dhttps://patchthecve.com/cve/CVE-2025-22611.htmlhttps://patchthecve.com/cve/CVE-2025-22611.htmlWed, 17 Jun 2026 08:48:41 +0000CRITICAL 9.9: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to escalate his or any other team members privileges to any role, including the owner role. He's also able to khttps://patchthecve.com/cve/CVE-2025-22610.htmlhttps://patchthecve.com/cve/CVE-2025-22610.htmlWed, 17 Jun 2026 08:48:41 +0000MEDIUM 6.5: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the global coolify instance OAuth configuration. This exposes the "client id" and "client secret" for https://patchthecve.com/cve/CVE-2025-22609.htmlhttps://patchthecve.com/cve/CVE-2025-22609.htmlWed, 17 Jun 2026 08:48:40 +0000CRITICAL 10.0: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of IP /https://patchthecve.com/cve/CVE-2025-22608.htmlhttps://patchthecve.com/cve/CVE-2025-22608.htmlWed, 17 Jun 2026 08:48:40 +0000MEDIUM 6.5: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to revoke any team invitations on a Coolify instance by only providing a predictable and incrementing ID, resulhttps://patchthecve.com/cve/CVE-2025-22607.htmlhttps://patchthecve.com/cve/CVE-2025-22607.htmlWed, 17 Jun 2026 08:48:39 +0000MEDIUM 5.5: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the details page for any GitHub / GitLab configuration on a Coolify instance by only knowing the UUID https://patchthecve.com/cve/CVE-2025-22606.htmlhttps://patchthecve.com/cve/CVE-2025-22606.htmlWed, 17 Jun 2026 08:48:39 +0000HIGH 7.8: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes uneschttps://patchthecve.com/cve/CVE-2025-22605.htmlhttps://patchthecve.com/cve/CVE-2025-22605.htmlWed, 17 Jun 2026 08:48:38 +0000HIGH 7.8: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Starting in version 4.0.0-beta.18 and prior to 4.0.0-beta.253, a vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local Coolif