CVE-2025-34157— Coolify Stored Cross-Site Scripting (XSS) in Project Name Field
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| coolLabs Technologies | Coolify | < 4.0.0.-beta.420.7 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-34157
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Coolify Stored Cross-Site Scripting (XSS) in Project Name Field
Source: NVD (National Vulnerability Database)
Vulnerability Description
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload executes in the admin’s browser context. This results in full compromise of the Coolify instance, including theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Coolify 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Coolify是coolLabs开源的一个开源和自托管的 Heroku/Netlify/Vercel 替代品。 Coolify v4.0.0-beta.420.6之前版本存在安全漏洞，该漏洞源于项目创建工作流中存在存储型跨站脚本，可能导致完全控制Coolify实例。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| coolLabs Technologies | Coolify | 0 ~ 4.0.0.-beta.420.7 | - |
II. Public POCs for CVE-2025-34157
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | A stored XSS in the project delete flow allows execution of attacker-controlled JavaScript in an administrator’s browser when the admin attempts to delete a project created by a low-privileged user. This can lead to takeover of the Coolify instance (cookies, API tokens, WebSocket/terminal actions) | https://github.com/Eyodav/CVE-2025-34157 | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-34157
请登录查看更多情报信息。
Same Patch Batch · coolLabs Technologies · 2025-08-27 · 3 CVEs total
| CVE-2025-34161 | Coolify Git Repository Field Command Injection in Project Deployment Workflow | |
| CVE-2025-34159 | Coolify Docker Compose Directive Injection in Application Deployment Workflow |
IV. Related Vulnerabilities
Same product: Coolify
- CVE-2025-64425
Coolify has host header injection in forgot password - CVE-2025-64424
Colify has command injection vulnerability in project git so - CVE-2025-64423
Coolify has a Privilege Escalation - low privileged users ca - CVE-2025-64422
Rate-limit bypass on login via X-Forwarded-Host header - CVE-2025-64421
Coolify has a privilege escalation - low privileged user can
Same weakness: CWE-79
- CVE-2026-27964
FacturaScripts: Reflected Cross-Site Scripting (XSS) via Coo - CVE-2026-27737
BigBlueButton has Stored XSS in bbb-playback replay - CVE-2026-45231
DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fiel - CVE-2026-45494
Microsoft Edge (Chromium-based) Spoofing Vulnerability - CVE-2026-7498
Stored XSS in Basamak Informatics' DernekWeb
V. Comments for CVE-2025-34157
No comments yet