Description
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload executes in the admin’s browser context. This results in full compromise of the Coolify instance, including theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| coolLabs Technologies | Coolify | < 4.0.0.-beta.420.7 | 4.0.0.-beta.420.7 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
Eyodav/CVE-2025-34157 ★ 0 · Aug 18, 2025
A stored XSS in the project delete flow allows execution of attacker-controlled JavaScript in an administrator’s browser when the admin attempts to delete a project created by a low-privileged user. …
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- Coolify 4.0.0-beta.420.7 Release Notes vendor-advisory patch release-notes
- https://coolify.io/ product
- https://github.com/Eyodav/CVE-2025-34157 technical-description exploit