Critical · published August 27, 2025
🚨 An authenticated user can turn a simple project name into a weapon in Coolify! This stored XSS vulnerability allows low-privileged users to execute malicious scripts when admins manage projects. 🔥 Imagine a guest at a party sneaking a prank note into the host's guestbook. When the host reads it aloud, the prank explodes into laughter, but it could just as easily trigger chaos if the note contained something harmful. That's how this XSS flaw can play out for administrators! With this vulnerability, an attacker can steal sensitive information from the admin's browser, including API tokens and session cookies. This means they could take full control of your Coolify instance, leading to data breaches and unauthorized access to managed servers. Pretty devastating!
Imagine a guest at a party sneaking a prank note into the host's guestbook. When the host reads it aloud, the prank explodes into laughter, but it could just as easily trigger chaos if the note contained something harmful. That's how this XSS flaw can play out for administrators! This CVE-2025-34157 is a stored XSS vulnerability in Coolify versions before 4.0.0-beta.420.6, allowing an authenticated low-privileged user to inject JavaScript in project names, which executes in the context of an administrator when managing projects.
With this vulnerability, an attacker can steal sensitive information from the admin's browser, including API tokens and session cookies. This means they could take full control of your Coolify instance, leading to data breaches and unauthorized access to managed servers. Pretty devastating! To protect yourself, immediately upgrade Coolify to version 4.0.0-beta.420.6 or later. Additionally, review user permissions and consider implementing input sanitization to prevent future exploits. Don't wait on this! You're on the right path to securing your application! Follow these steps and you'll have this locked down in no time. 🛡️