Back to KEVs

CVE-2025-35939

Craft CMS stores user-provided content in session files

Basic Information

CVE State
PUBLISHED
Reserved Date
April 15, 2025
Published Date
May 07, 2025
Last Updated
June 06, 2025
Vendor
Craft
Product
CMS
Description
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
Tags
php cisa

CVSS Scores

CVSS v4.0

6.9 - MEDIUM

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS v3.1

5.3 - MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Score

Score
43.97% (Percentile: 97.37%) as of 2025-06-14

SSVC Information

Exploitation
active
Automatable
Yes
Technical Impact
partial

Exploit Status

Exploited in the Wild
Yes (2025-06-02 18:00:35 UTC) Source

References

https://github.com/craftcms/cms/pull/17220 https://github.com/craftcms/cms/releases/tag/4.15.3 https://github.com/craftcms/cms/releases/tag/5.7.5 https://www.cve.org/CVERecord?id=CVE-2025-35939 https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json

Known Exploited Vulnerability Information

Source Added Date
CISA 2025-06-02 18:00:28 UTC

Recent Mentions

CISA Adds Five Known Exploited Vulnerabilities to Catalog

Source: All CISA Advisories • Published: 2025-06-02 12:00:00 UTC

CISA added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2021-32030 ASUS Routers Improper Authentication Vulnerability CVE-2023-39780 ASUS RT-AX55 Routers OS Command Injection Vulnerability CVE-2024-56145 Craft CMS Code Injection Vulnerability CVE-2025-3935 ConnectWise ScreenConnect Improper Authentication Vulnerability CVE-2025-35939 Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Please share your thoughts with us through our anonymous survey. We appreciate your feedback.

[craftcms/cms] Craft CMS stores arbitrary content provided by unauthenticated users in session files

Source: Github Advisory Database (Composer) • Published: 2025-05-08 00:31:12 UTC

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at /var/lib/php/sessions. Such session files are named sess_[session_value], where [session_value] is provided to the client in a Set-Cookie response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue. References https://nvd.nist.gov/vuln/detail/CVE-2025-35939 https://github.com/craftcms/cms/pull/17220 https://github.com/craftcms/cms/releases/tag/4.15.3 https://github.com/craftcms/cms/releases/tag/5.7.5 https://github.com/craftcms/cms/commit/e4c7bac8f31010aee048409f9ef6f744a83146b2 https://github.com/advisories/GHSA-7vrx-9684-xrf2

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel