CVE-2025-59158: Coolify Stored XSS Vulnerability

CVE-2025-59158 Overview

CVE-2025-59158 is a stored Cross-Site Scripting (XSS) vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The vulnerability exists in the project creation workflow where an authenticated user with low privileges (e.g., member role) can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator later attempts to delete the project or its associated resource, the payload automatically executes in the admin's browser context, potentially leading to privilege escalation and account compromise.

Critical Impact

This stored XSS vulnerability enables low-privileged users to escalate privileges by executing arbitrary JavaScript in administrator browser sessions, potentially leading to full administrative account takeover.

Affected Products

• Coolify versions prior to and including v4.0.0-beta.420.6
• Self-hosted Coolify instances running vulnerable versions
• Multi-user Coolify deployments with member-level access

Discovery Timeline

• 2026-01-05 - CVE CVE-2025-59158 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-59158

Vulnerability Analysis

This stored XSS vulnerability (CWE-116: Improper Encoding or Escaping of Output) affects Coolify's project creation workflow. The application fails to properly sanitize or encode user-supplied input in project names before rendering them in administrative interfaces. This allows an attacker with basic member-level access to inject malicious JavaScript payloads that persist in the database and execute whenever an administrator interacts with the compromised project entry.

The attack is particularly dangerous because it targets privileged users performing routine administrative tasks. When an administrator attempts to delete a project or manage its associated resources, the stored payload executes with the administrator's session context, potentially allowing the attacker to perform actions as the admin, steal session tokens, or further compromise the system.

Root Cause

The root cause is improper encoding or escaping of output (CWE-116) in Coolify's project management interface. The application accepts user input for project names but fails to properly encode special characters and HTML/JavaScript content before rendering this data in the browser. This allows embedded script tags and event handlers to be interpreted as executable code rather than being safely displayed as text.

Attack Vector

The attack follows a privilege escalation pattern through stored XSS:

1. Initial Access: An authenticated user with member-level privileges creates a new project through the legitimate project creation workflow
2. Payload Injection: The attacker crafts a project name containing malicious JavaScript, such as embedded <script> tags or event handlers
3. Persistence: The malicious payload is stored in the application's database without proper sanitization
4. Execution Trigger: When an administrator views the project list or attempts to delete the compromised project, the malicious JavaScript executes in their browser
5. Privilege Escalation: The payload can steal administrator session tokens, perform administrative actions, or create new admin accounts

The vulnerability requires user interaction (an administrator must interact with the poisoned project entry), but the low barrier to entry for authenticated users and the high-privilege target makes this a significant risk. For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-59158

Indicators of Compromise

• Unusual project names containing HTML tags, script elements, or JavaScript event handlers (e.g., onerror, onload, onclick)
• Database entries in project tables containing encoded or unencoded script payloads
• Administrator session anomalies or unexpected administrative actions following project management activities
• Browser console errors related to blocked scripts or Content Security Policy violations on the Coolify admin interface

Detection Strategies

• Implement web application firewall (WAF) rules to detect XSS patterns in HTTP POST requests to project creation endpoints
• Enable Content Security Policy (CSP) headers and monitor for CSP violation reports
• Deploy browser-based XSS detection mechanisms and audit project name fields for suspicious content patterns
• Review application logs for project creation events with abnormally long or encoded project names

Monitoring Recommendations

• Configure alerts for project creation events from member-level accounts that contain special characters or script-like patterns
• Monitor administrator sessions for unexpected API calls or state changes immediately following project deletion operations
• Implement database integrity monitoring to detect malicious content in project name fields
• Enable SentinelOne's web application protection capabilities to detect and block XSS payload execution attempts

How to Mitigate CVE-2025-59158

Immediate Actions Required

• Upgrade Coolify to version 4.0.0-beta.420.7 or later immediately
• Audit existing project names in the database for suspicious or malicious content
• Review recent project creation activity from member-level accounts for potential attack attempts
• Implement Content Security Policy headers as a defense-in-depth measure

Patch Information

Coolify version 4.0.0-beta.420.7 contains the official patch for this vulnerability. The patch implements proper output encoding for project names, ensuring that user-supplied content is safely escaped before being rendered in the browser. Organizations should prioritize upgrading to this version or later. Additional details about the fix can be found in the GitHub Security Advisory.

Workarounds

• Temporarily restrict project creation privileges to trusted administrators only until the patch can be applied
• Implement a reverse proxy or WAF rule to sanitize project names and block requests containing script tags or event handlers
• Manually audit and sanitize existing project names in the database to remove any potentially malicious content
• Enable strict Content Security Policy headers to mitigate the impact of any successful XSS injection

# Example CSP header configuration for defense-in-depth
# Add to your reverse proxy or web server configuration
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'self';