CVE-2025-59158 Coolify has Stored XSS in Project Name
Low-privilege users can inject JavaScript via project names, executing code in admin browsers during deletion, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-59158?
CVE-2025-59158 is a critical cross-site scripting vulnerability in coollabsio coolify, published on 5 Jan 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges (e.g., member role) can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator later attempts to delete the project or its associated resource, the payload automatically executes in the admin’s browser context. Version 4.0.0-beta.420.7 contains a patch for the issue.
Which versions are affected by CVE-2025-59158?
It affects 1 product.
Products include Coollabs Coolify.
How do I fix CVE-2025-59158?
No fix has been published for CVE-2025-59158 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-59158 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59158 exists.
Other vulnerabilities in coollabsio coolify
- CVE-2025-59157 Coolify has Git Repository RCE
- CVE-2025-64420 Coolify members can see private key of root user
- CVE-2025-66209 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup
- CVE-2025-22609 Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)
- CVE-2025-22611 Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE)
Sources
Also known as GHSA-h52r-jxv9-9vhf.