CVE-2025-35939Craft CMS stores user-provided content in session files
Updated under an hour ago ()
Does this affect you?
It affects Craft CMS and 1 other product. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Jun 2, 2025; federal agencies had to remediate by Jun 23, 2025. Treat that date as your deadline.
Do this next
Free account, 1 product
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
- CVSS
- 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-472
- Known exploited
- Added to CISA KEV Jun 2, 2025; federal remediation due Jun 23, 2025Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 1.35% (percentile 71)
- Assigned by
- cisa-cg
- NVD analysis
- Analyzed
- Record last updated
- Feb 26, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Craft CMS craft:cms (from the name) | before 5.7.5; 5.7.5 not affected; before 4.15.3; 4.15.3 not affected | CNA record |
craftcms craft_cms craftcms:craft_cms | before 4.15.3; from 5.0.0 before 5.7.5 | NVD |
References
- https://github.com/craftcms/cms/pull/17220patch
- https://github.com/craftcms/cms/releases/tag/4.15.3release-notes
- https://github.com/craftcms/cms/releases/tag/5.7.5release-notes
- https://www.cve.org/CVERecord?id=CVE-2025-35939vdb-entry
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.jsonthird-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.