Read the docs
TI-2025-24595 Aliases CVE-2025-35939GHSA-7vrx-9684-xrf2

Craft CMS stores user-provided content in session files

Priority CRITICAL 88Exploited in the wildCWE-472Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.

Why it matters now

Exploitation Active In CISA KEV since 2025-06-02CISA due date 2025-06-23
EPSS 0.01373 72nd percentileScored 2026-11-07
Fix Fixed CMS (Craft): 5.7.5, 4.15.3craftcms/cms (Packagist): 5.7.5, 4.15.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CraftCMSbefore 5.7.5; before 4.15.35.7.5, 4.15.3Patch availableCNA
—craftcms/cms (Packagist)5.0.0-alpha.1 to before 5.7.55.7.5Patch availableGHSA-7vrx-9684-xrf2
—craftcms/cms (Packagist)before 4.15.34.15.3Patch availableGHSA-7vrx-9684-xrf2
  • CMS VendorCraft Affected before 5.7.5; before 4.15.3 Fixed in 5.7.5, 4.15.3 Patch available CNA
  • craftcms/cms (Packagist) Vendor— Affected 5.0.0-alpha.1 to before 5.7.5 Fixed in 5.7.5 Patch available GHSA-7vrx-9684-xrf2
  • craftcms/cms (Packagist) Vendor— Affected before 4.15.3 Fixed in 4.15.3 Patch available GHSA-7vrx-9684-xrf2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*before 4.15.3; 5.0.0 to before 5.7.5VulnerableCraft CMS
  • cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* Versions before 4.15.3; 5.0.0 to before 5.7.5 Vulnerable ·Craft CMS

Remediation

  • Fix · CNA CMS (Craft) Fixed in 5.7.5, 4.15.3
  • Fix · GHSA-7vrx-9684-xrf2 craftcms/cms (Packagist) Fixed in 5.7.5 Advisory →
  • Fix · GHSA-7vrx-9684-xrf2 craftcms/cms (Packagist) Fixed in 4.15.3 Advisory →

Timeline

  1. 2025-06-02 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-35939
  3. 2026-10-03 Alias added: GHSA-7vrx-9684-xrf2

References

Patch 1

Advisory 2

Other 6

  • TI-2026-12470 Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization CVSS 4.0MEDIUM 5.3
  • TI-2026-12469 Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences