CVE-2025-34157 is a critical (CVSS 9.0) stored cross-site scripting flaw in Coolify versions before v4.0.0-beta.420.6. A low privilege user can plant script in a project name that runs when an admin deletes the project. Upgrade to v4.0.0-beta.420.7 or later as soon as you can.
What's affected
The record says Coolify versions prior to v4.0.0-beta.420.6 are affected. The Coolify release page for v4.0.0-beta.420.7, published on 26 August, says it updates external dependencies to fix multiple vulnerabilities and recommends updating as soon as possible. The release notes do not name this CVE, so confirm the fix version against the Coolify advisory or changelog for the exact release you choose.
Upgrading to the newest release is the safer goal, since later releases carry further fixes.
How to check if you're exposed
In the Coolify dashboard, open the settings or footer to read the current version. Anything older than v4.0.0-beta.420.6 is in range.
If you run an affected version, review project names in the dashboard and look for any that contain markup or script fragments instead of plain text. Also check who holds accounts with permission to create projects, since the record says a low privilege authenticated user is enough.
If you run Coolify from a container image, check the tag in your compose file or deployment settings, and use a scan of the image to see what it contains.
What to do now
- Identify every Coolify instance and its version.
- Upgrade to v4.0.0-beta.420.7 or a later release, and read the release notes.
- Until upgraded, avoid deleting projects with unusual names and limit who can create projects.
- Remove accounts that do not need access and enforce strong authentication for administrators.
- Review project names for markup and remove suspicious entries.
- If an admin deleted a project of unknown origin recently, rotate API tokens and sessions as a precaution.
Why it matters
The record maps this to CWE-79, cross-site scripting, and CWE-20, improper input validation. The project name is stored and later shown in an admin context without being encoded, so script supplied by a low privilege user executes in the administrator browser session.
That is why the score is high despite needing a login and a user action. According to the record, the result can be theft of API tokens and session cookies and access to WebSocket based terminal sessions on managed servers. A deployment platform sits close to your servers, so a flaw in its dashboard reaches far. The record does not flag exploitation in the wild, and the CVE is not on the CISA KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Who can trigger this?
An authenticated low privilege user plants the payload, and an administrator triggers it by deleting the project or a related resource.
Sources
Last reviewed: 18 October 2026.
