{"vulnerability": "CVE-2025-22609", "sightings": [{"uuid": "ce834c3e-c651-4e04-8331-230cc236442d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22609", "type": "seen", "source": "https://bsky.app/profile/tmjintel.bsky.social/post/3lgxwu2lt2y24", "content": "", "creation_timestamp": "2025-01-30T16:49:03.697690Z"}, {"uuid": "0d608119-4ecf-4cd2-b804-eaf521671d11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22609", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113884286733931596", "content": "", "creation_timestamp": "2025-01-24T16:31:49.376661Z"}, {"uuid": "a4e8ee44-5c79-4db9-a620-f65ebcd1ee67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22609", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/113884389353887186", "content": "", "creation_timestamp": "2025-01-24T16:57:55.355090Z"}, {"uuid": "22e1a455-77bb-44b4-a379-831b94bdc063", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22609", "type": "seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/113884588172935119", "content": "", "creation_timestamp": "2025-01-24T17:48:30.516827Z"}, {"uuid": "a8dd8763-734a-48a1-8274-ba0663d8db1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22609", "type": "seen", "source": "https://bsky.app/profile/dinosn.bsky.social/post/3lgxclr6auk2w", "content": "", "creation_timestamp": "2025-01-30T10:46:31.612830Z"}, {"uuid": "f8a9dfee-2c41-47f6-8ee9-3e4f9c444b15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-22609", "type": "seen", "source": "https://bsky.app/profile/kyosuke-tanaka.bsky.social/post/3lgubj3myys2n", "content": "", "creation_timestamp": "2025-01-29T05:49:07.428665Z"}, {"uuid": "62eb89d5-94fb-4896-8c46-7947f4ccf44f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22609", "type": "seen", "source": "https://bsky.app/profile/bolhasec.com/post/3loyfeaar2k2z", "content": "", "creation_timestamp": "2025-05-12T16:30:11.905701Z"}, {"uuid": "bafd5364-2751-4665-9f97-a874e5af75cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22609", "type": "seen", "source": "https://t.me/cvedetector/16307", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-22609 - Coolify Remote Command Execution as Unprivileged User\", \n  \"Content\": \"CVE ID : CVE-2025-22609 \nPublished : Jan. 24, 2025, 5:15 p.m. | 44\u00a0minutes ago \nDescription : Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can use the `Terminal` feature and execute arbitrary commands on the victim's server. Version 4.0.0-beta.361 fixes the issue. \nSeverity: 10.0 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"24 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-24T19:25:34.000000Z"}, {"uuid": "58fd76fb-d929-4b18-a870-f7f843903df2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22609", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/2953", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-22609\n\ud83d\udd39 Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can use the `Terminal` feature and execute arbitrary commands on the victim's server. Version 4.0.0-beta.361 fixes the issue.\n\ud83d\udccf Published: 2025-01-24T16:30:34.465Z\n\ud83d\udccf Modified: 2025-01-24T16:33:08.221Z\n\ud83d\udd17 References:\n1. https://github.com/coollabsio/coolify/security/advisories/GHSA-3w2c-jfr2-9pg9", "creation_timestamp": "2025-01-24T17:05:11.000000Z"}, {"uuid": "e7486bb0-46d7-4e9b-b0a1-e401cc52a0f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22609", "type": "seen", "source": "https://t.me/suboxone_chatroom/7370", "content": "CVE-2025-22609, -22611, -22612: Multiple vulnerabilities in Coolify, 10.0 rating \ud83d\udd25\ud83d\udd25\ud83d\udd25\n\nThree vulnerabilities of highest severity in Coolify allow for RCE, privilege escalation, and authentication bypass.\n\nSearch at Netlas.io:\n\ud83d\udc49 Link: https://nt.ls/vUWWf\n\ud83d\udc49 Dork: http.favicon.hash_sha256:eaf648b6000a49599ed58bda49e576d0f981e535a8075d524a4be890edcf96d0 AND uri:*login*\n\nVendor's advisory: https://github.com/coollabsio/coolify/security/advisories/GHSA-3w2c-jfr2-9pg9", "creation_timestamp": "2025-04-01T12:36:06.000000Z"}]}