Back to KEVs

CVE-2025-35939

Craft CMS stores user-provided content in session files

Basic Information

CVE State
PUBLISHED
Reserved Date
April 15, 2025
Published Date
May 07, 2025
Last Updated
February 26, 2026
Vendor
Craft
Product
CMS
Description
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
Tags
php cisa

CVSS Scores

CVSS v4.0

6.9 - MEDIUM

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS v3.1

5.3 - MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Score

Score
33.07% (Percentile: 96.98%) as of 2026-05-31

SSVC Information

Exploitation
active
Automatable
Yes
Technical Impact
partial

Exploit Status

Exploited in the Wild
Yes (2026-06-01 10:31:13 UTC) Source

References

https://github.com/craftcms/cms/pull/17220 https://github.com/craftcms/cms/releases/tag/4.15.3 https://github.com/craftcms/cms/releases/tag/5.7.5 https://www.cve.org/CVERecord?id=CVE-2025-35939 https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json

Known Exploited Vulnerability Information

Source Added Date
CVE 2026-06-01 10:31:06 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel