CVE-2025-59156: Coolify has Docker Compose Injection issue

Published Jan 5, 2026
·
Updated

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)vulnerability exists in Coolify's application deployment workflow. This flaw allows a low-privileged member to inject arbitrary Docker Compose directives during project creation or updates. By defining a malicious service that mounts the host filesystem, an attacker can achieve root-level command execution on the host OS, completely bypassing container isolation. Version 4.0.0-beta.420.7 contains a patch for the issue.

Affected Software

409 affected components
Coolify<4.0.0-beta.420.7
Coollabs Coolify<4.0.0
Coollabs Coolify=4.0.0-beta100
Coollabs Coolify=4.0.0-beta101
Coollabs Coolify=4.0.0-beta102
Coollabs Coolify=4.0.0-beta103
Coollabs Coolify=4.0.0-beta104
Coollabs Coolify=4.0.0-beta105
Coollabs Coolify=4.0.0-beta106
Coollabs Coolify=4.0.0-beta107
Coollabs Coolify=4.0.0-beta108
Coollabs Coolify=4.0.0-beta109
Coollabs Coolify=4.0.0-beta110
Coollabs Coolify=4.0.0-beta111
Coollabs Coolify=4.0.0-beta112
Coollabs Coolify=4.0.0-beta113
Coollabs Coolify=4.0.0-beta114
Coollabs Coolify=4.0.0-beta115
Coollabs Coolify=4.0.0-beta116
Coollabs Coolify=4.0.0-beta117
Coollabs Coolify=4.0.0-beta118
Coollabs Coolify=4.0.0-beta119
Coollabs Coolify=4.0.0-beta120
Coollabs Coolify=4.0.0-beta121
Coollabs Coolify=4.0.0-beta122
Coollabs Coolify=4.0.0-beta123
Coollabs Coolify=4.0.0-beta124
Coollabs Coolify=4.0.0-beta125
Coollabs Coolify=4.0.0-beta126
Coollabs Coolify=4.0.0-beta127
Coollabs Coolify=4.0.0-beta128
Coollabs Coolify=4.0.0-beta129
Coollabs Coolify=4.0.0-beta130
Coollabs Coolify=4.0.0-beta131
Coollabs Coolify=4.0.0-beta132
Coollabs Coolify=4.0.0-beta133
Coollabs Coolify=4.0.0-beta134
Coollabs Coolify=4.0.0-beta135
Coollabs Coolify=4.0.0-beta136
Coollabs Coolify=4.0.0-beta137
Coollabs Coolify=4.0.0-beta138
Coollabs Coolify=4.0.0-beta139
Coollabs Coolify=4.0.0-beta140
Coollabs Coolify=4.0.0-beta141
Coollabs Coolify=4.0.0-beta142
Coollabs Coolify=4.0.0-beta143
Coollabs Coolify=4.0.0-beta144
Coollabs Coolify=4.0.0-beta145
Coollabs Coolify=4.0.0-beta146
Coollabs Coolify=4.0.0-beta147
Coollabs Coolify=4.0.0-beta148
Coollabs Coolify=4.0.0-beta149
Coollabs Coolify=4.0.0-beta150
Coollabs Coolify=4.0.0-beta151
Coollabs Coolify=4.0.0-beta152
Coollabs Coolify=4.0.0-beta153
Coollabs Coolify=4.0.0-beta154
Coollabs Coolify=4.0.0-beta155
Coollabs Coolify=4.0.0-beta156
Coollabs Coolify=4.0.0-beta157
Coollabs Coolify=4.0.0-beta158
Coollabs Coolify=4.0.0-beta159
Coollabs Coolify=4.0.0-beta160
Coollabs Coolify=4.0.0-beta161
Coollabs Coolify=4.0.0-beta162
Coollabs Coolify=4.0.0-beta163
Coollabs Coolify=4.0.0-beta164
Coollabs Coolify=4.0.0-beta165
Coollabs Coolify=4.0.0-beta166
Coollabs Coolify=4.0.0-beta167
Coollabs Coolify=4.0.0-beta168
Coollabs Coolify=4.0.0-beta169
Coollabs Coolify=4.0.0-beta170
Coollabs Coolify=4.0.0-beta171
Coollabs Coolify=4.0.0-beta172
Coollabs Coolify=4.0.0-beta173
Coollabs Coolify=4.0.0-beta174
Coollabs Coolify=4.0.0-beta175
Coollabs Coolify=4.0.0-beta176
Coollabs Coolify=4.0.0-beta177
Coollabs Coolify=4.0.0-beta178
Coollabs Coolify=4.0.0-beta179
Coollabs Coolify=4.0.0-beta18
Coollabs Coolify=4.0.0-beta180
Coollabs Coolify=4.0.0-beta181
Coollabs Coolify=4.0.0-beta182
Coollabs Coolify=4.0.0-beta183
Coollabs Coolify=4.0.0-beta184
Coollabs Coolify=4.0.0-beta185
Coollabs Coolify=4.0.0-beta186
Coollabs Coolify=4.0.0-beta187
Coollabs Coolify=4.0.0-beta188
Coollabs Coolify=4.0.0-beta189
Coollabs Coolify=4.0.0-beta19
Coollabs Coolify=4.0.0-beta190
Coollabs Coolify=4.0.0-beta191
Coollabs Coolify=4.0.0-beta192
Coollabs Coolify=4.0.0-beta193
Coollabs Coolify=4.0.0-beta194
Coollabs Coolify=4.0.0-beta195
Coollabs Coolify=4.0.0-beta196
Coollabs Coolify=4.0.0-beta197
Coollabs Coolify=4.0.0-beta198
Coollabs Coolify=4.0.0-beta199
Coollabs Coolify=4.0.0-beta20
Coollabs Coolify=4.0.0-beta200
Coollabs Coolify=4.0.0-beta201
Coollabs Coolify=4.0.0-beta202
Coollabs Coolify=4.0.0-beta203
Coollabs Coolify=4.0.0-beta204
Coollabs Coolify=4.0.0-beta205
Coollabs Coolify=4.0.0-beta206
Coollabs Coolify=4.0.0-beta207
Coollabs Coolify=4.0.0-beta208
Coollabs Coolify=4.0.0-beta209
Coollabs Coolify=4.0.0-beta21
Coollabs Coolify=4.0.0-beta211
Coollabs Coolify=4.0.0-beta212
Coollabs Coolify=4.0.0-beta213
Coollabs Coolify=4.0.0-beta214
Coollabs Coolify=4.0.0-beta215
Coollabs Coolify=4.0.0-beta216
Coollabs Coolify=4.0.0-beta217
Coollabs Coolify=4.0.0-beta218
Coollabs Coolify=4.0.0-beta219
Coollabs Coolify=4.0.0-beta22
Coollabs Coolify=4.0.0-beta220
Coollabs Coolify=4.0.0-beta221
Coollabs Coolify=4.0.0-beta222
Coollabs Coolify=4.0.0-beta223
Coollabs Coolify=4.0.0-beta224
Coollabs Coolify=4.0.0-beta225
Coollabs Coolify=4.0.0-beta226
Coollabs Coolify=4.0.0-beta227
Coollabs Coolify=4.0.0-beta228
Coollabs Coolify=4.0.0-beta229
Coollabs Coolify=4.0.0-beta23
Coollabs Coolify=4.0.0-beta230
Coollabs Coolify=4.0.0-beta231
Coollabs Coolify=4.0.0-beta232
Coollabs Coolify=4.0.0-beta233
Coollabs Coolify=4.0.0-beta234
Coollabs Coolify=4.0.0-beta235
Coollabs Coolify=4.0.0-beta236
Coollabs Coolify=4.0.0-beta237
Coollabs Coolify=4.0.0-beta238
Coollabs Coolify=4.0.0-beta239
Coollabs Coolify=4.0.0-beta24
Coollabs Coolify=4.0.0-beta240
Coollabs Coolify=4.0.0-beta241
Coollabs Coolify=4.0.0-beta242
Coollabs Coolify=4.0.0-beta243
Coollabs Coolify=4.0.0-beta244
Coollabs Coolify=4.0.0-beta245
Coollabs Coolify=4.0.0-beta246
Coollabs Coolify=4.0.0-beta247
Coollabs Coolify=4.0.0-beta248
Coollabs Coolify=4.0.0-beta249
Coollabs Coolify=4.0.0-beta25
Coollabs Coolify=4.0.0-beta250
Coollabs Coolify=4.0.0-beta251
Coollabs Coolify=4.0.0-beta252
Coollabs Coolify=4.0.0-beta253
Coollabs Coolify=4.0.0-beta254
Coollabs Coolify=4.0.0-beta255
Coollabs Coolify=4.0.0-beta256
Coollabs Coolify=4.0.0-beta257
Coollabs Coolify=4.0.0-beta258
Coollabs Coolify=4.0.0-beta259
Coollabs Coolify=4.0.0-beta26
Coollabs Coolify=4.0.0-beta260
Coollabs Coolify=4.0.0-beta261
Coollabs Coolify=4.0.0-beta262
Coollabs Coolify=4.0.0-beta263
Coollabs Coolify=4.0.0-beta264
Coollabs Coolify=4.0.0-beta265
Coollabs Coolify=4.0.0-beta266
Coollabs Coolify=4.0.0-beta267
Coollabs Coolify=4.0.0-beta268
Coollabs Coolify=4.0.0-beta269
Coollabs Coolify=4.0.0-beta27
Coollabs Coolify=4.0.0-beta270
Coollabs Coolify=4.0.0-beta271
Coollabs Coolify=4.0.0-beta272
Coollabs Coolify=4.0.0-beta273
Coollabs Coolify=4.0.0-beta274
Coollabs Coolify=4.0.0-beta275
Coollabs Coolify=4.0.0-beta276
Coollabs Coolify=4.0.0-beta277
Coollabs Coolify=4.0.0-beta278
Coollabs Coolify=4.0.0-beta279
Coollabs Coolify=4.0.0-beta28
Coollabs Coolify=4.0.0-beta280
Coollabs Coolify=4.0.0-beta281
Coollabs Coolify=4.0.0-beta282
Coollabs Coolify=4.0.0-beta283
Coollabs Coolify=4.0.0-beta284
Coollabs Coolify=4.0.0-beta285
Coollabs Coolify=4.0.0-beta286
Coollabs Coolify=4.0.0-beta287
Coollabs Coolify=4.0.0-beta288
Coollabs Coolify=4.0.0-beta289
Coollabs Coolify=4.0.0-beta29
Coollabs Coolify=4.0.0-beta290
Coollabs Coolify=4.0.0-beta291
Coollabs Coolify=4.0.0-beta292
Coollabs Coolify=4.0.0-beta293
Coollabs Coolify=4.0.0-beta294
Coollabs Coolify=4.0.0-beta295
Coollabs Coolify=4.0.0-beta296
Coollabs Coolify=4.0.0-beta297
Coollabs Coolify=4.0.0-beta298
Coollabs Coolify=4.0.0-beta299
Coollabs Coolify=4.0.0-beta30
Coollabs Coolify=4.0.0-beta300
Coollabs Coolify=4.0.0-beta301
Coollabs Coolify=4.0.0-beta302
Coollabs Coolify=4.0.0-beta303
Coollabs Coolify=4.0.0-beta304
Coollabs Coolify=4.0.0-beta305
Coollabs Coolify=4.0.0-beta306
Coollabs Coolify=4.0.0-beta307
Coollabs Coolify=4.0.0-beta308
Coollabs Coolify=4.0.0-beta309
Coollabs Coolify=4.0.0-beta31
Coollabs Coolify=4.0.0-beta310
Coollabs Coolify=4.0.0-beta311
Coollabs Coolify=4.0.0-beta312
Coollabs Coolify=4.0.0-beta313
Coollabs Coolify=4.0.0-beta314
Coollabs Coolify=4.0.0-beta315
Coollabs Coolify=4.0.0-beta316
Coollabs Coolify=4.0.0-beta317
Coollabs Coolify=4.0.0-beta318
Coollabs Coolify=4.0.0-beta319
Coollabs Coolify=4.0.0-beta32
Coollabs Coolify=4.0.0-beta320
Coollabs Coolify=4.0.0-beta321
Coollabs Coolify=4.0.0-beta322
Coollabs Coolify=4.0.0-beta323
Coollabs Coolify=4.0.0-beta324
Coollabs Coolify=4.0.0-beta325
Coollabs Coolify=4.0.0-beta326
Coollabs Coolify=4.0.0-beta327
Coollabs Coolify=4.0.0-beta328
Coollabs Coolify=4.0.0-beta329
Coollabs Coolify=4.0.0-beta33
Coollabs Coolify=4.0.0-beta330
Coollabs Coolify=4.0.0-beta331
Coollabs Coolify=4.0.0-beta332
Coollabs Coolify=4.0.0-beta333
Coollabs Coolify=4.0.0-beta334
Coollabs Coolify=4.0.0-beta335
Coollabs Coolify=4.0.0-beta336
Coollabs Coolify=4.0.0-beta337
Coollabs Coolify=4.0.0-beta338
Coollabs Coolify=4.0.0-beta339
Coollabs Coolify=4.0.0-beta34
Coollabs Coolify=4.0.0-beta340
Coollabs Coolify=4.0.0-beta341
Coollabs Coolify=4.0.0-beta342
Coollabs Coolify=4.0.0-beta343
Coollabs Coolify=4.0.0-beta344
Coollabs Coolify=4.0.0-beta345
Coollabs Coolify=4.0.0-beta346
Coollabs Coolify=4.0.0-beta347
Coollabs Coolify=4.0.0-beta348
Coollabs Coolify=4.0.0-beta349
Coollabs Coolify=4.0.0-beta35
Coollabs Coolify=4.0.0-beta350
Coollabs Coolify=4.0.0-beta351
Coollabs Coolify=4.0.0-beta352
Coollabs Coolify=4.0.0-beta353
Coollabs Coolify=4.0.0-beta354
Coollabs Coolify=4.0.0-beta355
Coollabs Coolify=4.0.0-beta356
Coollabs Coolify=4.0.0-beta357
Coollabs Coolify=4.0.0-beta358
Coollabs Coolify=4.0.0-beta359
Coollabs Coolify=4.0.0-beta36
Coollabs Coolify=4.0.0-beta360
Coollabs Coolify=4.0.0-beta361
Coollabs Coolify=4.0.0-beta362
Coollabs Coolify=4.0.0-beta363
Coollabs Coolify=4.0.0-beta364
Coollabs Coolify=4.0.0-beta365
Coollabs Coolify=4.0.0-beta366
Coollabs Coolify=4.0.0-beta367
Coollabs Coolify=4.0.0-beta368
Coollabs Coolify=4.0.0-beta369
Coollabs Coolify=4.0.0-beta37
Coollabs Coolify=4.0.0-beta370
Coollabs Coolify=4.0.0-beta371
Coollabs Coolify=4.0.0-beta372
Coollabs Coolify=4.0.0-beta373
Coollabs Coolify=4.0.0-beta374
Coollabs Coolify=4.0.0-beta375
Coollabs Coolify=4.0.0-beta376
Coollabs Coolify=4.0.0-beta377
Coollabs Coolify=4.0.0-beta378
Coollabs Coolify=4.0.0-beta379
Coollabs Coolify=4.0.0-beta38
Coollabs Coolify=4.0.0-beta380
Coollabs Coolify=4.0.0-beta381
Coollabs Coolify=4.0.0-beta382
Coollabs Coolify=4.0.0-beta383
Coollabs Coolify=4.0.0-beta384
Coollabs Coolify=4.0.0-beta385
Coollabs Coolify=4.0.0-beta386
Coollabs Coolify=4.0.0-beta387
Coollabs Coolify=4.0.0-beta388
Coollabs Coolify=4.0.0-beta389
Coollabs Coolify=4.0.0-beta39
Coollabs Coolify=4.0.0-beta390
Coollabs Coolify=4.0.0-beta391
Coollabs Coolify=4.0.0-beta392
Coollabs Coolify=4.0.0-beta393
Coollabs Coolify=4.0.0-beta394
Coollabs Coolify=4.0.0-beta395
Coollabs Coolify=4.0.0-beta396
Coollabs Coolify=4.0.0-beta397
Coollabs Coolify=4.0.0-beta398
Coollabs Coolify=4.0.0-beta399
Coollabs Coolify=4.0.0-beta40
Coollabs Coolify=4.0.0-beta400
Coollabs Coolify=4.0.0-beta401
Coollabs Coolify=4.0.0-beta402
Coollabs Coolify=4.0.0-beta404
Coollabs Coolify=4.0.0-beta405
Coollabs Coolify=4.0.0-beta406
Coollabs Coolify=4.0.0-beta407
Coollabs Coolify=4.0.0-beta408
Coollabs Coolify=4.0.0-beta409
Coollabs Coolify=4.0.0-beta41
Coollabs Coolify=4.0.0-beta410
Coollabs Coolify=4.0.0-beta411
Coollabs Coolify=4.0.0-beta412
Coollabs Coolify=4.0.0-beta413
Coollabs Coolify=4.0.0-beta414
Coollabs Coolify=4.0.0-beta415
Coollabs Coolify=4.0.0-beta416
Coollabs Coolify=4.0.0-beta417
Coollabs Coolify=4.0.0-beta418
Coollabs Coolify=4.0.0-beta419
Coollabs Coolify=4.0.0-beta42
Coollabs Coolify=4.0.0-beta420
Coollabs Coolify=4.0.0-beta420.1
Coollabs Coolify=4.0.0-beta420.2
Coollabs Coolify=4.0.0-beta420.3
Coollabs Coolify=4.0.0-beta420.4
Coollabs Coolify=4.0.0-beta420.5
Coollabs Coolify=4.0.0-beta420.6
Coollabs Coolify=4.0.0-beta43
Coollabs Coolify=4.0.0-beta44
Coollabs Coolify=4.0.0-beta45
Coollabs Coolify=4.0.0-beta46
Coollabs Coolify=4.0.0-beta47
Coollabs Coolify=4.0.0-beta48
Coollabs Coolify=4.0.0-beta49
Coollabs Coolify=4.0.0-beta50
Coollabs Coolify=4.0.0-beta51
Coollabs Coolify=4.0.0-beta52
Coollabs Coolify=4.0.0-beta53
Coollabs Coolify=4.0.0-beta54
Coollabs Coolify=4.0.0-beta55
Coollabs Coolify=4.0.0-beta56
Coollabs Coolify=4.0.0-beta57
Coollabs Coolify=4.0.0-beta58
Coollabs Coolify=4.0.0-beta59
Coollabs Coolify=4.0.0-beta60
Coollabs Coolify=4.0.0-beta61
Coollabs Coolify=4.0.0-beta62
Coollabs Coolify=4.0.0-beta63
Coollabs Coolify=4.0.0-beta64
Coollabs Coolify=4.0.0-beta65
Coollabs Coolify=4.0.0-beta66
Coollabs Coolify=4.0.0-beta67
Coollabs Coolify=4.0.0-beta68
Coollabs Coolify=4.0.0-beta69
Coollabs Coolify=4.0.0-beta70
Coollabs Coolify=4.0.0-beta71
Coollabs Coolify=4.0.0-beta72
Coollabs Coolify=4.0.0-beta73
Coollabs Coolify=4.0.0-beta74
Coollabs Coolify=4.0.0-beta75
Coollabs Coolify=4.0.0-beta76
Coollabs Coolify=4.0.0-beta77
Coollabs Coolify=4.0.0-beta78
Coollabs Coolify=4.0.0-beta79
Coollabs Coolify=4.0.0-beta80
Coollabs Coolify=4.0.0-beta81
Coollabs Coolify=4.0.0-beta82
Coollabs Coolify=4.0.0-beta83
Coollabs Coolify=4.0.0-beta84
Coollabs Coolify=4.0.0-beta85
Coollabs Coolify=4.0.0-beta86
Coollabs Coolify=4.0.0-beta87
Coollabs Coolify=4.0.0-beta88
Coollabs Coolify=4.0.0-beta89
Coollabs Coolify=4.0.0-beta90
Coollabs Coolify=4.0.0-beta91
Coollabs Coolify=4.0.0-beta92
Coollabs Coolify=4.0.0-beta93
Coollabs Coolify=4.0.0-beta94
Coollabs Coolify=4.0.0-beta95
Coollabs Coolify=4.0.0-beta96
Coollabs Coolify=4.0.0-beta97
Coollabs Coolify=4.0.0-beta98
Coollabs Coolify=4.0.0-beta99

Event History

Jan 5, 2026
CVE Published
via MITRE·05:39 PM
Data Sourced
via MITRE·05:39 PM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-59156?

CVE-2025-59156 has a critical severity level due to the potential for Remote Code Execution.

2

How do I fix CVE-2025-59156?

To fix CVE-2025-59156, upgrade Coolify to version 4.0.0-beta.420.7 or later.

3

What type of vulnerability is CVE-2025-59156?

CVE-2025-59156 is a Remote Code Execution (RCE) vulnerability.

4

Who is affected by CVE-2025-59156?

CVE-2025-59156 affects users of Coolify versions prior to 4.0.0-beta.420.7.

5

Can a low-privileged member exploit CVE-2025-59156?

Yes, a low-privileged member can exploit CVE-2025-59156 to inject malicious code.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203