PT-2026-1314 · Coolify · Coolify

Published 2026-01-05 · Updated 2026-01-12 · CVE-2025-59158

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.420.7

Description Coolify is a self-hostable tool for managing servers, applications, and databases. A stored cross-site scripting (XSS) issue exists in the project creation workflow. An authenticated user with low privileges can create a project with a malicious name containing JavaScript. When an administrator attempts to delete the project or its associated resource, the payload executes in the administrator’s browser. The vulnerable component is the project creation workflow, where the project name is not properly sanitized. The API endpoint used for project creation is not specified. The vulnerable parameter is the project name.

Recommendations Update to Coolify version 4.0.0-beta.420.7 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2025-59158

GHSA-H52R-JXV9-9VHF

Affected Products

Coolify

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59158.json · Exploit
• https://github.com/coollabsio/coolify/security/advisories/GHSA-h52r-jxv9-9vhf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59158 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59158 · Vendor Advisory
• https://twitter.com/CVEnew/status/2008251287658512660 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2008261614995206389 · Twitter Post
• https://twitter.com/ActiveITSolutns/status/2010711515255439850 · Twitter Post