CVE-2025-35939

Published May 7, 2025

Last updated 23 days ago

Craft CMS

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-35939 affects Craft CMS, where unauthenticated users can store arbitrary content in session files. This is due to the CMS storing return URLs without proper sanitization. When an unauthenticated request is redirected to the login page, Craft CMS generates a session file at `/var/lib/php/sessions` named `sess_[session_value]`, with the session value provided to the client via a Set-Cookie header. An unauthenticated attacker could inject arbitrary values, including potentially malicious PHP code, into a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this vulnerability by implementing proper sanitization of return URLs before they are saved to the PHP session.

Description: Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
Source: 9119a7d8-5eab-497f-8521-727c672e3725
NVD status: Analyzed

Risk scores

CVSS 4.0

Type: Secondary
Base score: 6.9
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: MEDIUM

CVSS 3.1

Type: Primary
Base score: 5.3
Impact score: 1.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity: MEDIUM

Known exploits

Data from CISA

Vulnerability name: Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
Exploit added on: Jun 2, 2025
Exploit action due: Jun 23, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

9119a7d8-5eab-497f-8521-727c672e3725: CWE-472
nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8C8B256D-000B-4588-8182-CEC2ACC076EB",
            "versionEndExcluding": "4.15.3"
          },
          {
            "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "61BCA33B-AEA5-45AA-A757-9348C48A4728",
            "versionEndExcluding": "5.7.5",
            "versionStartIncluding": "5.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.