Read the docs
TI-2025-24250 Aliases CVE-2025-34086GHSA-p9qc-8jjx-g8cg

Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename

Priority MEDIUM 48CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file. NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04322 91st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BoltCMSup to 3.7.0—No fix listedCNA
—bolt/bolt (Packagist)up to 3.7.0—No fix listedGHSA-p9qc-8jjx-g8cg
  • CMS VendorBolt Affected up to 3.7.0 Fixed in — No fix listed CNA
  • bolt/bolt (Packagist) Vendor— Affected up to 3.7.0 Fixed in — No fix listed GHSA-p9qc-8jjx-g8cg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:boltcms:bolt:*:*:*:*:*:*:*:*up to 3.7.0VulnerableBoltcms
  • cpe:2.3:a:boltcms:bolt:*:*:*:*:*:*:*:* Versions up to 3.7.0 Vulnerable ·Boltcms

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34086
  2. 2026-10-03 Alias added: GHSA-p9qc-8jjx-g8cg
  3. 2026-10-04 EPSS moved to the 90th–95th percentile

References

Exploit 2

Patch 1

Advisory 2

Other 2

  • TI-2022-16851 Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an… CVSS 3.1HIGH 8.8
  • TI-2024-06761 Bolt CMS Showcase Creation showcases cross site scripting CVSS 4.0MEDIUM 5.3
  • TI-2024-06760 Bolt CMS Entry Preview page cross site scripting CVSS 4.0MEDIUM 5.3
  • TI-2026-09940 Bolt CMS HTML Attribute TextType.php HTML injection CVSS 4.0MEDIUM 5.1
  • TI-2021-17367 Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. CVSS 3.1HIGH 8.8
  • TI-2026-49958 Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering CVSS 3.1HIGH 8.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences