CVE-2025-34157

Katalog CVE

CVSS 9.0 · Critical EPSS 0,46%

Kerentanan Improper Input Validation pada coollabs coolify. Skor CVSS 3.1 9.0 (Critical) menurut NVD.

Deskripsi (NVD)

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload executes in the admin’s browser context. This results in full compromise of the Coolify instance, including theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers.

Rincian

Terbit di NVD

27 Agustus 2025

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 408 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://github.com/Eyodav/CVE-2025-34157 advisory pihak ketiga
• https://coolify.io/ product
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7 release notes