Vulnerability · Published Aug 27, 2025 · Assigned by VulnCheck

CVE-2025-34157Coolify Stored Cross-Site Scripting (XSS) in Project Name Field

Critical 9.4

In plain English

A critical-severity cross-site scripting in Coolify from coolLabs Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.5%top 58.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload executes in the admin’s browser context. This results in full compromise of the Coolify instance, including theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers.

Affected products (as reported)

Vendor	Product	Versions
coolLabs Technologies	Coolify	0 – before 4.0.0.-beta.420.7

Weakness: CWE-79, CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7 vendor-advisory, patch
https://coolify.io/ product
https://github.com/Eyodav/CVE-2025-34157 technical-description, exploit