Back to Database
Status published
Low
CVE-2025-24025
Coolify Vulnerable to Reflected XSS on Tag Search
Vulnerability Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users to search for tags. If the search does not return any results, the query gets reflected on the error modal, which leads to cross-site scripting. Version 4.0.0-beta.380 fixes the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-24025
Credits & Attribution
No credits recorded in the NVD database.
More from coollabsio
View All →CVE-2025-66213
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path
Critical
9.4
CVE-2025-66212
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename
Critical
9.4
CVE-2025-66211
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename
Critical
9.4
CVE-2025-66210
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import
Critical
9.4
CVE-2025-66209
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup
Critical
10
Affected Vendor
coollabsio
View all reports →Affected Software
coolify
Vulnerable Versions:
< 4.0.0-beta.361
Timeline
Official Publish:
January 24th, 2025
Last Modified:
January 24th, 2025
Added to House:
July 22nd, 2026