CVE-2025-35939

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-35939
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-35939.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-35939
Aliases
Published
2025-05-07T23:15:54.103Z
Modified
2026-03-15T22:51:31.482122Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[sessionvalue]', where '[sessionvalue]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.

References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7ad3a61e84c0266d24e34d8ce3ebd13154d60b92
Introduced
f6a8fb685d44e387435825e3a96809eeda4973a6
Fixed
679b82edce8c60ce1008dc70740bf2610adac57d
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.15.3"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.7.5"
        }
    ]
}

Affected versions

3.*
3.9.13
3.9.14
3.9.15
4.*
4.10.0
4.10.0-beta.1
4.10.0-beta.2
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.11.0
4.11.0.1
4.11.0.2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.12.0
4.12.1
4.12.2
4.12.3
4.12.4
4.12.4.1
4.12.5
4.12.6
4.12.6.1
4.12.7
4.12.8
4.12.9
4.13.0
4.13.1
4.13.1.1
4.13.10
4.13.2
4.13.3
4.13.4
4.13.5
4.13.6
4.13.7
4.13.8
4.13.9
4.14.0
4.14.0.1
4.14.0.2
4.14.1
4.14.10
4.14.11
4.14.11.1
4.14.12
4.14.13
4.14.14
4.14.15
4.14.2
4.14.3
4.14.4
4.14.5
4.14.6
4.14.7
4.14.8
4.14.8.1
4.14.9
4.15.0
4.15.0-beta.1
4.15.0-beta.2
4.15.0.1
4.15.0.2
4.15.1
4.15.2
4.8.10
4.8.11
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
5.*
5.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-35939.json"