Is CVE-2025-34157 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-34157 being exploited in the wild.

How severe is CVE-2025-34157?

Critical severity, with a CVSS score of 9, published 27 August 2025.

Which products and versions are affected?

coollabsio Coolify prior to v4.0.0-beta.420.7.

Is there a fix for CVE-2025-34157?

A patch was published on 2025-08-26: Fixed in version v4.0.0-beta.420.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-34157 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-34157?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-34157: Coollabs Coolify stored XSS in project creation workflow

CVE-2025-34157 · Severity: critical · CVSS 9 · Published 2025-08-27

Coolify, an open-source platform for deploying and managing web applications and databases, is vulnerable to a security flaw that allows low-privileged users to take over the entire system. By creating a project with a specially crafted name, an attacker can execute malicious code in an administrator's browser when the admin attempts to delete that project. This could lead to the theft of sensitive API tokens, session cookies, and unauthorized access to terminal sessions on managed servers.

Quick answers

Is CVE-2025-34157 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-34157 being exploited in the wild.
How severe is CVE-2025-34157?: Critical severity, with a CVSS score of 9, published 27 August 2025.
Which products and versions are affected?: coollabsio Coolify prior to v4.0.0-beta.420.7.
Is there a fix for CVE-2025-34157?: A patch was published on 2025-08-26: Fixed in version v4.0.0-beta.420.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-34157 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-34157?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Coolify's project creation workflow due to improper input validation of project names. An authenticated attacker with low privileges (e.g., a 'member' role) can inject a malicious JavaScript payload into a project name. When an administrator interacts with the project—specifically during the deletion flow or when viewing associated resources—the payload executes within the administrator's browser context. This enables the attacker to perform actions with administrative privileges, including stealing session cookies, API tokens, and hijacking WebSocket-based terminal sessions on managed servers. The issue is fixed in version v4.0.0-beta.420.7.

Affected products

coollabsio Coolify prior to v4.0.0-beta.420.7

Timeline

2025-08-26: patched: Fixed in version v4.0.0-beta.420.7
2025-08-27: advisory: CVE-2025-34157 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.