Vulnerabilities

TI-2025-24311 CVE-2025-34157 · GHSA-6p37-qg9q-mprw

Coolify Stored Cross-Site Scripting (XSS) in Project Name Field

MEDIUM 43

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow.

CVSS 4.0CRITICAL 9.4 Network Low privileges User interaction EPSS 0.00481 Published 2025-08-27 Fixed in 4.0.0.-beta.420.7 CWE-20

TI-2025-24313 CVE-2025-34159 · GHSA-qh8c-f279-4cgv

MEDIUM 44

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00971 Published 2025-08-27 Fixed in 4.0.0-beta.420.7 CWE-20

TI-2025-24315 CVE-2025-34161 · GHSA-xp99-74mm-rpv2

MEDIUM 48

Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.02963 Published 2025-08-27 Fixed in 4.0.0-beta.420.7 CWE-20