CVE-2025-59158

🚨 An authenticated user, even with low privileges, can embed malicious JavaScript into project names that later execute when an admin tries to delete them! 🔥 Think of it like a prankster slipping a remote-controlled device into a legitimate delivery box. When the unsuspecting recipient opens it, the device springs to life, causing chaos! That's how this XSS vulnerability can unleash its payload in an admin’s browser. This stored XSS attack could lead to devastating consequences! An attacker could hijack session cookies, execute unauthorized commands, or even access sensitive data. Essentially, it allows them to take control of the admin's browser, turning their own interface against them!

This stored XSS attack could lead to devastating consequences! An attacker could hijack session cookies, execute unauthorized commands, or even access sensitive data. Essentially, it allows them to take control of the admin's browser, turning their own interface against them! Immediate action is crucial! Upgrade to Coolify version 4.0.0-beta.420.7 or later to patch this vulnerability. Additionally, implement stricter input validation for project names to prevent similar issues in the future. You've got this! By following these steps, you can secure your Coolify instance and keep the bad guys out! 🛡️