Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2025-34086: Bolt CMS lets logged-in users run code on server
CVE-2025-34086 · published 1 year ago
Summary
Versions of Bolt CMS up to 3.7 let anyone with a valid login add malicious code to their profile and then rename internal session files so the code can be executed as a web page. This can give an attacker full control of the web server. Update to a newer, supported version of Bolt CMS or remove access for untrusted users and delete any suspicious session files.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | bolt | bolt | <= 3.7.0 |
| – | boltcms | bolt |
<= 3.7.0 cpe:2.3:a:boltcms:bolt:*:*:*:*:*:*:*:* |
| – | bolt | cms | <= 3.7.0 |
Original advisory text
Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename
Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file.
NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.
NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.
References
- https://www.rapid7.com/db/modules/exploit/unix/webapp/bolt_authenticated_rce
- https://github.com/bolt/bolt/blob/3.7/src/Controller/Backend/Users.php#L279-L311
- https://github.com/advisories/GHSA-p9qc-8jjx-g8cg
- https://nvd.nist.gov/vuln/detail/CVE-2025-34086 Vendor Advisory
- https://boltcms.io/newsitem/major-announcements-bolt-3-eol-bolt-4-2-5-0-releases Vendor Advisory
- https://www.rapid7.com/db/modules/exploit/unix/webapp/bolt_authenticated_rce/ Vendor Advisory
- https://github.com/bolt/bolt/releases/tag/3.7.1 Patch
- https://github.com/bolt/bolt Product
- https://www.exploit-db.com/exploits/48296 Exploit
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exp... Exploit
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/34xxx/CVE-2025-34086... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-94Code Injection
CWE-434Unrestricted File Upload
Timeline
Published3 Jul 2025
Updated24 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta