CVE-2025-35939

CVE-2025-35939 is a medium-severity vulnerability in Craftcms Craft Cms with a CVSS 3.x base score of 5.3. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2025-06-02). The underlying weakness is classified as CWE-472.

Key facts

Description

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.

Frequently asked questions

What is CVE-2025-35939?
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
How severe is CVE-2025-35939?
CVE-2025-35939 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2025-35939 being actively exploited?
Yes. CVE-2025-35939 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2025-06-02, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2025-35939?
CVE-2025-35939 affects Craftcms Craft Cms. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-35939?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2025-35939 have an EU (EUVD) identifier?
Yes. CVE-2025-35939 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-13951. It is also flagged as exploited in the EUVD (since 2025-06-02).
When was CVE-2025-35939 published?
CVE-2025-35939 was published on 2025-05-07 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Craftcms Craft Cms

All CVEs affecting Craftcms Craft Cms →

Other CWE-472 vulnerabilities

Browse all CWE-472 vulnerabilities →