Skip to contentCoollabsio Coolify vulnerabilities
- coollabsio coolifycoollabsio coolify Image Name os command injectionCVE-2026-128155.3 Medium
- coollabs coolifyCoolify has host header injection in forgot passwordCVE-2025-644258.5 High
- coollabs coolifyColify has command injection vulnerability in project git sourceCVE-2025-64424Public exploit9.4 Critical
- coollabs coolifyCoolify has a Privilege Escalation - low privileged users can see and use admin invitation linksCVE-2025-644237.7 High
- coollabs coolifyRate-limit bypass on login via X-Forwarded-Host headerCVE-2025-644225.5 Medium
- coollabs coolifyCoolify has a privilege escalation - low privileged user can invite themselves as an admin userCVE-2025-644218.7 High
- coollabs coolifyCoolify members can see private key of root userCVE-2025-6442010.0 Critical
- coollabs coolifyCoolify vulnerable to command injection via docker-compose.yaml parametersCVE-2025-644199.7 Critical
- coollabs coolifyCoolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpointCVE-2025-599555.7 Medium
- coollabs coolifyCoolify has Stored XSS in Project NameCVE-2025-591589.4 Critical
- coollabs coolifyCoolify has Git Repository RCECVE-2025-5915710.0 Critical
- coollabs coolifyCoolify has Docker Compose Injection issueCVE-2025-591569.4 Critical
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount PathCVE-2025-662139.4 Critical
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration FilenameCVE-2025-662129.4 Critical
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script FilenameCVE-2025-662119.4 Critical
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database ImportCVE-2025-662109.4 Critical
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database BackupCVE-2025-66209Public exploit10.0 Critical
- coollabs coolifyCoolify Stored Cross-Site Scripting (XSS) in Project Name FieldCVE-2025-34157Public exploit9.4 Critical
- coollabs coolifyCoolify Docker Compose Directive Injection in Application Deployment WorkflowCVE-2025-34159Public exploit9.4 Critical
- coollabs coolifyCoolify Git Repository Field Command Injection in Project Deployment WorkflowCVE-2025-34161Public exploit9.4 Critical
- coollabs coolifyCoolify Vulnerable to Reflected XSS on Tag SearchCVE-2025-240251.3 Low
- coollabs coolifyCoolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE)CVE-2025-2261210.0 Critical
- coollabs coolifyCoolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE)CVE-2025-2261110.0 Critical
- coollabs coolifyCoolify Vulnerable to OAuth Secrets LeakCVE-2025-226105.7 Medium
- coollabs coolifyCoolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)CVE-2025-2260910.0 Critical
- coollabs coolifyCoolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS)CVE-2025-226086.5 Medium
- coollabs coolifyCoolify Vulnerable to GitHub / GitLab OAuth Secrets LeakCVE-2025-226074.7 Medium
- coollabs coolifyCoolify Command Injection Vulnerability in Project NameCVE-2025-226068.5 High
- coollabs coolifyCoolify OS Command Injection Vulnerability in SSH Command GenerationCVE-2025-226058.5 High