Read the docs
TI-2020-03530 Aliases CVE-2020-4041GHSA-68q3-7wjp-7q3j

The filename of uploaded files vulnerable to stored XSS in Bolt CMS

Priority LOW 37CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.

Why it matters now

EPSS 0.02077 81st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed bolt (bolt): 3.7.1bolt/bolt (Packagist): 3.7.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Boltboltbefore 3.7.13.7.1Patch availableCNA
—bolt/bolt (Packagist)before 3.7.13.7.1Patch availableGHSA-68q3-7wjp-7q3j
  • bolt VendorBolt Affected before 3.7.1 Fixed in 3.7.1 Patch available CNA
  • bolt/bolt (Packagist) Vendor— Affected before 3.7.1 Fixed in 3.7.1 Patch available GHSA-68q3-7wjp-7q3j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:boltcms:bolt:*:*:*:*:*:*:*:*before 3.7.1VulnerableBoltcms
  • cpe:2.3:a:boltcms:bolt:*:*:*:*:*:*:*:* Versions before 3.7.1 Vulnerable ·Boltcms

Remediation

  • Fix · CNA bolt (bolt) Fixed in 3.7.1
  • Fix · GHSA-68q3-7wjp-7q3j bolt/bolt (Packagist) Fixed in 3.7.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-4041
  2. 2026-10-03 Alias added: GHSA-68q3-7wjp-7q3j

References

Exploit 2

Patch 3

Advisory 1

Other 1

  • TI-2022-16851 Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an… CVSS 3.1HIGH 8.8
  • TI-2024-06761 Bolt CMS Showcase Creation showcases cross site scripting CVSS 4.0MEDIUM 5.3
  • TI-2024-06760 Bolt CMS Entry Preview page cross site scripting CVSS 4.0MEDIUM 5.3
  • TI-2026-09940 Bolt CMS HTML Attribute TextType.php HTML injection CVSS 4.0MEDIUM 5.1
  • TI-2025-24250 Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename CVSS 4.0HIGH 7.5
  • TI-2021-17367 Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. CVSS 3.1HIGH 8.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences