CVE-2025-34157
27.08.2025, 17:15
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload executes in the admins browser context. This results in full compromise of the Coolify instance, including theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers.
| Vendor | Product | Version |
|---|---|---|
| coollabs | coolify | 𝑥 < 4.0.0 |
| coollabs | coolify | 4.0.0:beta100 |
| coollabs | coolify | 4.0.0:beta101 |
| coollabs | coolify | 4.0.0:beta102 |
| coollabs | coolify | 4.0.0:beta103 |
| coollabs | coolify | 4.0.0:beta104 |
| coollabs | coolify | 4.0.0:beta105 |
| coollabs | coolify | 4.0.0:beta106 |
| coollabs | coolify | 4.0.0:beta107 |
| coollabs | coolify | 4.0.0:beta108 |
| coollabs | coolify | 4.0.0:beta109 |
| coollabs | coolify | 4.0.0:beta110 |
| coollabs | coolify | 4.0.0:beta111 |
| coollabs | coolify | 4.0.0:beta112 |
| coollabs | coolify | 4.0.0:beta113 |
| coollabs | coolify | 4.0.0:beta114 |
| coollabs | coolify | 4.0.0:beta115 |
| coollabs | coolify | 4.0.0:beta116 |
| coollabs | coolify | 4.0.0:beta117 |
| coollabs | coolify | 4.0.0:beta118 |
| coollabs | coolify | 4.0.0:beta119 |
| coollabs | coolify | 4.0.0:beta120 |
| coollabs | coolify | 4.0.0:beta121 |
| coollabs | coolify | 4.0.0:beta122 |
| coollabs | coolify | 4.0.0:beta123 |
| coollabs | coolify | 4.0.0:beta124 |
| coollabs | coolify | 4.0.0:beta125 |
| coollabs | coolify | 4.0.0:beta126 |
| coollabs | coolify | 4.0.0:beta127 |
| coollabs | coolify | 4.0.0:beta128 |
| coollabs | coolify | 4.0.0:beta129 |
| coollabs | coolify | 4.0.0:beta130 |
| coollabs | coolify | 4.0.0:beta131 |
| coollabs | coolify | 4.0.0:beta132 |
| coollabs | coolify | 4.0.0:beta133 |
| coollabs | coolify | 4.0.0:beta134 |
| coollabs | coolify | 4.0.0:beta135 |
| coollabs | coolify | 4.0.0:beta136 |
| coollabs | coolify | 4.0.0:beta137 |
| coollabs | coolify | 4.0.0:beta138 |
| coollabs | coolify | 4.0.0:beta139 |
| coollabs | coolify | 4.0.0:beta140 |
| coollabs | coolify | 4.0.0:beta141 |
| coollabs | coolify | 4.0.0:beta142 |
| coollabs | coolify | 4.0.0:beta143 |
| coollabs | coolify | 4.0.0:beta144 |
| coollabs | coolify | 4.0.0:beta145 |
| coollabs | coolify | 4.0.0:beta146 |
| coollabs | coolify | 4.0.0:beta147 |
| coollabs | coolify | 4.0.0:beta148 |
| coollabs | coolify | 4.0.0:beta149 |
| coollabs | coolify | 4.0.0:beta150 |
| coollabs | coolify | 4.0.0:beta151 |
| coollabs | coolify | 4.0.0:beta152 |
| coollabs | coolify | 4.0.0:beta153 |
| coollabs | coolify | 4.0.0:beta154 |
| coollabs | coolify | 4.0.0:beta155 |
| coollabs | coolify | 4.0.0:beta156 |
| coollabs | coolify | 4.0.0:beta157 |
| coollabs | coolify | 4.0.0:beta158 |
| coollabs | coolify | 4.0.0:beta159 |
| coollabs | coolify | 4.0.0:beta160 |
| coollabs | coolify | 4.0.0:beta161 |
| coollabs | coolify | 4.0.0:beta162 |
| coollabs | coolify | 4.0.0:beta163 |
| coollabs | coolify | 4.0.0:beta164 |
| coollabs | coolify | 4.0.0:beta165 |
| coollabs | coolify | 4.0.0:beta166 |
| coollabs | coolify | 4.0.0:beta167 |
| coollabs | coolify | 4.0.0:beta168 |
| coollabs | coolify | 4.0.0:beta169 |
| coollabs | coolify | 4.0.0:beta170 |
| coollabs | coolify | 4.0.0:beta171 |
| coollabs | coolify | 4.0.0:beta172 |
| coollabs | coolify | 4.0.0:beta173 |
| coollabs | coolify | 4.0.0:beta174 |
| coollabs | coolify | 4.0.0:beta175 |
| coollabs | coolify | 4.0.0:beta176 |
| coollabs | coolify | 4.0.0:beta177 |
| coollabs | coolify | 4.0.0:beta178 |
| coollabs | coolify | 4.0.0:beta179 |
| coollabs | coolify | 4.0.0:beta18 |
| coollabs | coolify | 4.0.0:beta180 |
| coollabs | coolify | 4.0.0:beta181 |
| coollabs | coolify | 4.0.0:beta182 |
| coollabs | coolify | 4.0.0:beta183 |
| coollabs | coolify | 4.0.0:beta184 |
| coollabs | coolify | 4.0.0:beta185 |
| coollabs | coolify | 4.0.0:beta186 |
| coollabs | coolify | 4.0.0:beta187 |
| coollabs | coolify | 4.0.0:beta188 |
| coollabs | coolify | 4.0.0:beta189 |
| coollabs | coolify | 4.0.0:beta19 |
| coollabs | coolify | 4.0.0:beta190 |
| coollabs | coolify | 4.0.0:beta191 |
| coollabs | coolify | 4.0.0:beta192 |
| coollabs | coolify | 4.0.0:beta193 |
| coollabs | coolify | 4.0.0:beta194 |
| coollabs | coolify | 4.0.0:beta195 |
| coollabs | coolify | 4.0.0:beta196 |
| coollabs | coolify | 4.0.0:beta197 |
| coollabs | coolify | 4.0.0:beta198 |
| coollabs | coolify | 4.0.0:beta199 |
| coollabs | coolify | 4.0.0:beta20 |
| coollabs | coolify | 4.0.0:beta200 |
| coollabs | coolify | 4.0.0:beta201 |
| coollabs | coolify | 4.0.0:beta202 |
| coollabs | coolify | 4.0.0:beta203 |
| coollabs | coolify | 4.0.0:beta204 |
| coollabs | coolify | 4.0.0:beta205 |
| coollabs | coolify | 4.0.0:beta206 |
| coollabs | coolify | 4.0.0:beta207 |
| coollabs | coolify | 4.0.0:beta208 |
| coollabs | coolify | 4.0.0:beta209 |
| coollabs | coolify | 4.0.0:beta21 |
| coollabs | coolify | 4.0.0:beta211 |
| coollabs | coolify | 4.0.0:beta212 |
| coollabs | coolify | 4.0.0:beta213 |
| coollabs | coolify | 4.0.0:beta214 |
| coollabs | coolify | 4.0.0:beta215 |
| coollabs | coolify | 4.0.0:beta216 |
| coollabs | coolify | 4.0.0:beta217 |
| coollabs | coolify | 4.0.0:beta218 |
| coollabs | coolify | 4.0.0:beta219 |
| coollabs | coolify | 4.0.0:beta22 |
| coollabs | coolify | 4.0.0:beta220 |
| coollabs | coolify | 4.0.0:beta221 |
| coollabs | coolify | 4.0.0:beta222 |
| coollabs | coolify | 4.0.0:beta223 |
| coollabs | coolify | 4.0.0:beta224 |
| coollabs | coolify | 4.0.0:beta225 |
| coollabs | coolify | 4.0.0:beta226 |
| coollabs | coolify | 4.0.0:beta227 |
| coollabs | coolify | 4.0.0:beta228 |
| coollabs | coolify | 4.0.0:beta229 |
| coollabs | coolify | 4.0.0:beta23 |
| coollabs | coolify | 4.0.0:beta230 |
| coollabs | coolify | 4.0.0:beta231 |
| coollabs | coolify | 4.0.0:beta232 |
| coollabs | coolify | 4.0.0:beta233 |
| coollabs | coolify | 4.0.0:beta234 |
| coollabs | coolify | 4.0.0:beta235 |
| coollabs | coolify | 4.0.0:beta236 |
| coollabs | coolify | 4.0.0:beta237 |
| coollabs | coolify | 4.0.0:beta238 |
| coollabs | coolify | 4.0.0:beta239 |
| coollabs | coolify | 4.0.0:beta24 |
| coollabs | coolify | 4.0.0:beta240 |
| coollabs | coolify | 4.0.0:beta241 |
| coollabs | coolify | 4.0.0:beta242 |
| coollabs | coolify | 4.0.0:beta243 |
| coollabs | coolify | 4.0.0:beta244 |
| coollabs | coolify | 4.0.0:beta245 |
| coollabs | coolify | 4.0.0:beta246 |
| coollabs | coolify | 4.0.0:beta247 |
| coollabs | coolify | 4.0.0:beta248 |
| coollabs | coolify | 4.0.0:beta249 |
| coollabs | coolify | 4.0.0:beta25 |
| coollabs | coolify | 4.0.0:beta250 |
| coollabs | coolify | 4.0.0:beta251 |
| coollabs | coolify | 4.0.0:beta252 |
| coollabs | coolify | 4.0.0:beta253 |
| coollabs | coolify | 4.0.0:beta254 |
| coollabs | coolify | 4.0.0:beta255 |
| coollabs | coolify | 4.0.0:beta256 |
| coollabs | coolify | 4.0.0:beta257 |
| coollabs | coolify | 4.0.0:beta258 |
| coollabs | coolify | 4.0.0:beta259 |
| coollabs | coolify | 4.0.0:beta26 |
| coollabs | coolify | 4.0.0:beta260 |
| coollabs | coolify | 4.0.0:beta261 |
| coollabs | coolify | 4.0.0:beta262 |
| coollabs | coolify | 4.0.0:beta263 |
| coollabs | coolify | 4.0.0:beta264 |
| coollabs | coolify | 4.0.0:beta265 |
| coollabs | coolify | 4.0.0:beta266 |
| coollabs | coolify | 4.0.0:beta267 |
| coollabs | coolify | 4.0.0:beta268 |
| coollabs | coolify | 4.0.0:beta269 |
| coollabs | coolify | 4.0.0:beta27 |
| coollabs | coolify | 4.0.0:beta270 |
| coollabs | coolify | 4.0.0:beta271 |
| coollabs | coolify | 4.0.0:beta272 |
| coollabs | coolify | 4.0.0:beta273 |
| coollabs | coolify | 4.0.0:beta274 |
| coollabs | coolify | 4.0.0:beta275 |
| coollabs | coolify | 4.0.0:beta276 |
| coollabs | coolify | 4.0.0:beta277 |
| coollabs | coolify | 4.0.0:beta278 |
| coollabs | coolify | 4.0.0:beta279 |
| coollabs | coolify | 4.0.0:beta28 |
| coollabs | coolify | 4.0.0:beta280 |
| coollabs | coolify | 4.0.0:beta281 |
| coollabs | coolify | 4.0.0:beta282 |
| coollabs | coolify | 4.0.0:beta283 |
| coollabs | coolify | 4.0.0:beta284 |
| coollabs | coolify | 4.0.0:beta285 |
| coollabs | coolify | 4.0.0:beta286 |
| coollabs | coolify | 4.0.0:beta287 |
| coollabs | coolify | 4.0.0:beta288 |
| coollabs | coolify | 4.0.0:beta289 |
| coollabs | coolify | 4.0.0:beta29 |
| coollabs | coolify | 4.0.0:beta290 |
| coollabs | coolify | 4.0.0:beta291 |
| coollabs | coolify | 4.0.0:beta292 |
| coollabs | coolify | 4.0.0:beta293 |
| coollabs | coolify | 4.0.0:beta294 |
| coollabs | coolify | 4.0.0:beta295 |
| coollabs | coolify | 4.0.0:beta296 |
| coollabs | coolify | 4.0.0:beta297 |
| coollabs | coolify | 4.0.0:beta298 |
| coollabs | coolify | 4.0.0:beta299 |
| coollabs | coolify | 4.0.0:beta30 |
| coollabs | coolify | 4.0.0:beta300 |
| coollabs | coolify | 4.0.0:beta301 |
| coollabs | coolify | 4.0.0:beta302 |
| coollabs | coolify | 4.0.0:beta303 |
| coollabs | coolify | 4.0.0:beta304 |
| coollabs | coolify | 4.0.0:beta305 |
| coollabs | coolify | 4.0.0:beta306 |
| coollabs | coolify | 4.0.0:beta307 |
| coollabs | coolify | 4.0.0:beta308 |
| coollabs | coolify | 4.0.0:beta309 |
| coollabs | coolify | 4.0.0:beta31 |
| coollabs | coolify | 4.0.0:beta310 |
| coollabs | coolify | 4.0.0:beta311 |
| coollabs | coolify | 4.0.0:beta312 |
| coollabs | coolify | 4.0.0:beta313 |
| coollabs | coolify | 4.0.0:beta314 |
| coollabs | coolify | 4.0.0:beta315 |
| coollabs | coolify | 4.0.0:beta316 |
| coollabs | coolify | 4.0.0:beta317 |
| coollabs | coolify | 4.0.0:beta318 |
| coollabs | coolify | 4.0.0:beta319 |
| coollabs | coolify | 4.0.0:beta32 |
| coollabs | coolify | 4.0.0:beta320 |
| coollabs | coolify | 4.0.0:beta321 |
| coollabs | coolify | 4.0.0:beta322 |
| coollabs | coolify | 4.0.0:beta323 |
| coollabs | coolify | 4.0.0:beta324 |
| coollabs | coolify | 4.0.0:beta325 |
| coollabs | coolify | 4.0.0:beta326 |
| coollabs | coolify | 4.0.0:beta327 |
| coollabs | coolify | 4.0.0:beta328 |
| coollabs | coolify | 4.0.0:beta329 |
| coollabs | coolify | 4.0.0:beta33 |
| coollabs | coolify | 4.0.0:beta330 |
| coollabs | coolify | 4.0.0:beta331 |
| coollabs | coolify | 4.0.0:beta332 |
| coollabs | coolify | 4.0.0:beta333 |
| coollabs | coolify | 4.0.0:beta334 |
| coollabs | coolify | 4.0.0:beta335 |
| coollabs | coolify | 4.0.0:beta336 |
| coollabs | coolify | 4.0.0:beta337 |
| coollabs | coolify | 4.0.0:beta338 |
| coollabs | coolify | 4.0.0:beta339 |
| coollabs | coolify | 4.0.0:beta34 |
| coollabs | coolify | 4.0.0:beta340 |
| coollabs | coolify | 4.0.0:beta341 |
| coollabs | coolify | 4.0.0:beta342 |
| coollabs | coolify | 4.0.0:beta343 |
| coollabs | coolify | 4.0.0:beta344 |
| coollabs | coolify | 4.0.0:beta345 |
| coollabs | coolify | 4.0.0:beta346 |
| coollabs | coolify | 4.0.0:beta347 |
| coollabs | coolify | 4.0.0:beta348 |
| coollabs | coolify | 4.0.0:beta349 |
| coollabs | coolify | 4.0.0:beta35 |
| coollabs | coolify | 4.0.0:beta350 |
| coollabs | coolify | 4.0.0:beta351 |
| coollabs | coolify | 4.0.0:beta352 |
| coollabs | coolify | 4.0.0:beta353 |
| coollabs | coolify | 4.0.0:beta354 |
| coollabs | coolify | 4.0.0:beta355 |
| coollabs | coolify | 4.0.0:beta356 |
| coollabs | coolify | 4.0.0:beta357 |
| coollabs | coolify | 4.0.0:beta358 |
| coollabs | coolify | 4.0.0:beta359 |
| coollabs | coolify | 4.0.0:beta36 |
| coollabs | coolify | 4.0.0:beta360 |
| coollabs | coolify | 4.0.0:beta361 |
| coollabs | coolify | 4.0.0:beta362 |
| coollabs | coolify | 4.0.0:beta363 |
| coollabs | coolify | 4.0.0:beta364 |
| coollabs | coolify | 4.0.0:beta365 |
| coollabs | coolify | 4.0.0:beta366 |
| coollabs | coolify | 4.0.0:beta367 |
| coollabs | coolify | 4.0.0:beta368 |
| coollabs | coolify | 4.0.0:beta369 |
| coollabs | coolify | 4.0.0:beta37 |
| coollabs | coolify | 4.0.0:beta370 |
| coollabs | coolify | 4.0.0:beta371 |
| coollabs | coolify | 4.0.0:beta372 |
| coollabs | coolify | 4.0.0:beta373 |
| coollabs | coolify | 4.0.0:beta374 |
| coollabs | coolify | 4.0.0:beta375 |
| coollabs | coolify | 4.0.0:beta376 |
| coollabs | coolify | 4.0.0:beta377 |
| coollabs | coolify | 4.0.0:beta378 |
| coollabs | coolify | 4.0.0:beta379 |
| coollabs | coolify | 4.0.0:beta38 |
| coollabs | coolify | 4.0.0:beta380 |
| coollabs | coolify | 4.0.0:beta381 |
| coollabs | coolify | 4.0.0:beta382 |
| coollabs | coolify | 4.0.0:beta383 |
| coollabs | coolify | 4.0.0:beta384 |
| coollabs | coolify | 4.0.0:beta385 |
| coollabs | coolify | 4.0.0:beta386 |
| coollabs | coolify | 4.0.0:beta387 |
| coollabs | coolify | 4.0.0:beta388 |
| coollabs | coolify | 4.0.0:beta389 |
| coollabs | coolify | 4.0.0:beta39 |
| coollabs | coolify | 4.0.0:beta390 |
| coollabs | coolify | 4.0.0:beta391 |
| coollabs | coolify | 4.0.0:beta392 |
| coollabs | coolify | 4.0.0:beta393 |
| coollabs | coolify | 4.0.0:beta394 |
| coollabs | coolify | 4.0.0:beta395 |
| coollabs | coolify | 4.0.0:beta396 |
| coollabs | coolify | 4.0.0:beta397 |
| coollabs | coolify | 4.0.0:beta398 |
| coollabs | coolify | 4.0.0:beta399 |
| coollabs | coolify | 4.0.0:beta40 |
| coollabs | coolify | 4.0.0:beta400 |
| coollabs | coolify | 4.0.0:beta401 |
| coollabs | coolify | 4.0.0:beta402 |
| coollabs | coolify | 4.0.0:beta404 |
| coollabs | coolify | 4.0.0:beta405 |
| coollabs | coolify | 4.0.0:beta406 |
| coollabs | coolify | 4.0.0:beta407 |
| coollabs | coolify | 4.0.0:beta408 |
| coollabs | coolify | 4.0.0:beta409 |
| coollabs | coolify | 4.0.0:beta41 |
| coollabs | coolify | 4.0.0:beta410 |
| coollabs | coolify | 4.0.0:beta411 |
| coollabs | coolify | 4.0.0:beta412 |
| coollabs | coolify | 4.0.0:beta413 |
| coollabs | coolify | 4.0.0:beta414 |
| coollabs | coolify | 4.0.0:beta415 |
| coollabs | coolify | 4.0.0:beta416 |
| coollabs | coolify | 4.0.0:beta417 |
| coollabs | coolify | 4.0.0:beta418 |
| coollabs | coolify | 4.0.0:beta419 |
| coollabs | coolify | 4.0.0:beta42 |
| coollabs | coolify | 4.0.0:beta420 |
| coollabs | coolify | 4.0.0:beta420.1 |
| coollabs | coolify | 4.0.0:beta420.2 |
| coollabs | coolify | 4.0.0:beta420.3 |
| coollabs | coolify | 4.0.0:beta420.4 |
| coollabs | coolify | 4.0.0:beta420.5 |
| coollabs | coolify | 4.0.0:beta420.6 |
| coollabs | coolify | 4.0.0:beta43 |
| coollabs | coolify | 4.0.0:beta44 |
| coollabs | coolify | 4.0.0:beta45 |
| coollabs | coolify | 4.0.0:beta46 |
| coollabs | coolify | 4.0.0:beta47 |
| coollabs | coolify | 4.0.0:beta48 |
| coollabs | coolify | 4.0.0:beta49 |
| coollabs | coolify | 4.0.0:beta50 |
| coollabs | coolify | 4.0.0:beta51 |
| coollabs | coolify | 4.0.0:beta52 |
| coollabs | coolify | 4.0.0:beta53 |
| coollabs | coolify | 4.0.0:beta54 |
| coollabs | coolify | 4.0.0:beta55 |
| coollabs | coolify | 4.0.0:beta56 |
| coollabs | coolify | 4.0.0:beta57 |
| coollabs | coolify | 4.0.0:beta58 |
| coollabs | coolify | 4.0.0:beta59 |
| coollabs | coolify | 4.0.0:beta60 |
| coollabs | coolify | 4.0.0:beta61 |
| coollabs | coolify | 4.0.0:beta62 |
| coollabs | coolify | 4.0.0:beta63 |
| coollabs | coolify | 4.0.0:beta64 |
| coollabs | coolify | 4.0.0:beta65 |
| coollabs | coolify | 4.0.0:beta66 |
| coollabs | coolify | 4.0.0:beta67 |
| coollabs | coolify | 4.0.0:beta68 |
| coollabs | coolify | 4.0.0:beta69 |
| coollabs | coolify | 4.0.0:beta70 |
| coollabs | coolify | 4.0.0:beta71 |
| coollabs | coolify | 4.0.0:beta72 |
| coollabs | coolify | 4.0.0:beta73 |
| coollabs | coolify | 4.0.0:beta74 |
| coollabs | coolify | 4.0.0:beta75 |
| coollabs | coolify | 4.0.0:beta76 |
| coollabs | coolify | 4.0.0:beta77 |
| coollabs | coolify | 4.0.0:beta78 |
| coollabs | coolify | 4.0.0:beta79 |
| coollabs | coolify | 4.0.0:beta80 |
| coollabs | coolify | 4.0.0:beta81 |
| coollabs | coolify | 4.0.0:beta82 |
| coollabs | coolify | 4.0.0:beta83 |
| coollabs | coolify | 4.0.0:beta84 |
| coollabs | coolify | 4.0.0:beta85 |
| coollabs | coolify | 4.0.0:beta86 |
| coollabs | coolify | 4.0.0:beta87 |
| coollabs | coolify | 4.0.0:beta88 |
| coollabs | coolify | 4.0.0:beta89 |
| coollabs | coolify | 4.0.0:beta90 |
| coollabs | coolify | 4.0.0:beta91 |
| coollabs | coolify | 4.0.0:beta92 |
| coollabs | coolify | 4.0.0:beta93 |
| coollabs | coolify | 4.0.0:beta94 |
| coollabs | coolify | 4.0.0:beta95 |
| coollabs | coolify | 4.0.0:beta96 |
| coollabs | coolify | 4.0.0:beta97 |
| coollabs | coolify | 4.0.0:beta98 |
| coollabs | coolify | 4.0.0:beta99 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-20 - Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.