CVE-2025-34159 is a critical remote code execution vulnerability in Coolify, a platform by coolLabs Technologies. The flaw exists in versions prior to v4.0.0-beta.420.6 and allows authenticated users with low-level privileges to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can escalate privileges to gain full root access on the server hosting the application. This vulnerability is classified under CWE-94 (Improper Control of Generation of Code) and CWE-20 (Improper Input Validation). The CVSS 4.0 base score is 9.4, reflecting its critical severity and high impact on confidentiality, integrity, and availability.

Successful exploitation results in remote code execution with root privileges on the underlying server. This compromises the entire system, allowing an attacker to execute arbitrary commands, access sensitive data, and potentially control the host environment.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user privileges to trusted users only and monitor for suspicious activity related to project creation workflows. Avoid deploying vulnerable versions in production environments.