Coolify CVE-2025-59158

Requires (1) an authenticated account with at least low-privilege 'member' role on the Coolify instance, and (2) the specific project-creation workflow where a project name is stored without output escaping (CWE-116). Exploitation is NOT self-triggering: the stored payload only fires when a higher-privileged administrator later opens the delete flow for that project or its associated resource (UI:P/UI:R). Limiting factors: multi-tenant or team deployments where untrusted members can create projects are the realistic exposure; single-admin self-hosted instances with no untrusted members are effectively not exposed. Affected in versions up to and including v4.0.0-beta.420.6; patched in v4.0.0-beta.420.7.

Signals are mixed and point to a moderate, not critical, real-world priority despite the vendor's CVSS 4.0 base of 9.4. The 9.4 is inflated because the vendor rated all impact metrics High (VC/VI/VA:H and subsequent SC/SI/SA:H); for a stored XSS whose payload runs in an administrator's browser, the realistic direct impact is closer to Low confidentiality/integrity with a scope change, not full High across the board. The attack is authenticated (PR:L - a low-privilege member role is required) and conditioned on victim interaction (UI:P), namely an administrator later opening the delete workflow for the malicious project/resource, which meaningfully constrains automatic or drive-by exploitation. EPSS is very low at 0.05% (15th percentile), consistent with no observed mass exploitation. There is NO CISA KEV listing, so this is not confirmed as actively exploited; however, publicly available exploit/advisory detail exists via the GitHub Security Advisory (GHSA-h52r-jxv9-9vhf). Net: this is a legitimate, patch-worthy stored XSS with a plausible admin-account-compromise pivot (Coolify manages servers/apps/databases, so hijacking an admin session could cascade to infrastructure control), but the authentication requirement, required admin interaction, and low EPSS place it below true critical urgency. The gap between the vendor 9.4 and these mitigating factors should be reconciled - the base score overstates impact for a browser-context XSS.

A low-privilege member in a shared Coolify instance creates a new project whose name embeds a JavaScript payload. The payload is stored unescaped and lies dormant until an administrator navigates to delete that project or its associated resource, at which point the script executes in the admin's authenticated browser context and can steal the admin session or issue actions as the admin. Public advisory detail exists (GHSA-h52r-jxv9-9vhf), lowering the bar to reproduce.