CVE-2025-59158 Coollabs CVE debrief

Who should care

Administrators and users with project creation privileges in Coolify should assess exposure and prioritize updating to version 4.0.0-beta.420.7 or later. Affected deployments should restrict project creation to administrators or trusted users and monitor for suspicious project names or admin actions.

Why it matters

Defenders should care about this vulnerability because it allows an authenticated user with low privileges to execute malicious JavaScript in an admin's browser context, potentially leading to unauthorized actions or data exposure. Affected deployments should prioritize updating to version 4.0.0-beta.420.7 or later and restrict project creation to administrators or trusted users.

• Cross-site scripting (XSS) payload execution in admin context
• Potential for unauthorized actions or data exposure
• Need for inventory checks and version verification
• Remediation priority for affected deployments

Technical summary

Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript, which executes when an administrator later attempts to delete the project or its associated resource. The vulnerability allows an authenticated user with low privileges to execute malicious JavaScript in an admin's browser context, potentially leading to unauthorized actions or data exposure.

Defensive priority

Defenders should prioritize updating Coolify to version 4.0.0-beta.420.7 or later to address the stored cross-site scripting (XSS) vulnerability.

Recommended defensive actions

• Update Coolify to version 4.0.0-beta.420.7 or later
• Restrict project creation to administrators or trusted users
• Monitor for suspicious project names or admin actions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but limited details are available on exploitation or impact. The vulnerability allows an authenticated user with low privileges to execute malicious JavaScript in an admin's browser context, potentially leading to unauthorized actions or data exposure. Affected deployments should prioritize updating to version 4.0.0-beta.420.7 or later and restrict project creation to administrators or trusted users.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.