Dashboard / CVE-2025-34161

CVE-2025-34161

CRITICAL 1 PoC
INFO Priority: 0.28 BB Relevance: 79/100
Published: 2025-08-27 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: High
VA: High

Description

Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, resulting in full server compromise.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
coolLabs Technologies Coolify 0 < 4.0.0-beta.420.7

References & Advisories (3)

https://github.com/Eyodav/CVE-2025-34161
technical-description exploit

Proof of Concept (1)

★ 1
https://github.com/Eyodav/CVE-2025-34161
nomi-sec

Bug Bounty Relevance

79 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

9.4 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS — Exploitation Probability

2.96%
Raw Score 0.029630
Percentile 87.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.02963
2026-11-12
0.02963
2026-11-10
0.02963
2026-11-09
0.02963
2026-11-08
0.02963

Intelligence Sources

mitre ref →

External Links