CVE-2025-34157 is a stored XSS vulnerability in Coolify before v4.0.0-beta.420.6. It allows an authenticated user with low privileges to create a project with a malicious name containing embedded JavaScript. This payload executes in the context of an administrator's browser when they attempt to delete the project or its resources. The exploitation results in complete compromise of the Coolify instance, including theft of sensitive credentials and access to WebSocket-based terminal sessions on managed servers. The vulnerability arises from improper neutralization of input during web page generation (CWE-79).

Successful exploitation leads to full compromise of the Coolify instance. Attackers can steal API tokens, session cookies, and gain access to WebSocket terminal sessions on managed servers, enabling unauthorized control and data theft. The vulnerability requires an authenticated low-privilege user and user interaction by an administrator.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict project creation permissions to trusted users and exercise caution when administrators delete projects or resources. Monitor vendor advisories for updates on remediation.