Executive brief
Craft CMS, a popular content management system, contains a vulnerability that allows unauthenticated users to inject malicious data into server session files. By manipulating web parameters that the system assumes are safe, an attacker can place arbitrary code on the server's disk. This could lead to a full system takeover if combined with other vulnerabilities, potentially resulting in data theft or website defacement.
Technical details
Craft CMS is vulnerable to an 'External Control of Assumed-Immutable Web Parameter' (CWE-472). When an unauthenticated user attempts to access a protected resource, the application redirects them to the login page and stores the requested return URL in a session file located at '/var/lib/php/sessions'. Because the return URL parameters are not properly sanitized, an attacker can inject arbitrary PHP code into these session files. While this vulnerability primarily allows for file poisoning, it can be chained with other vulnerabilities (such as CVE-2024-58136) to achieve remote code execution. The issue is addressed in Craft CMS versions 5.7.5 and 4.15.3.
Affected products
- Pixel & Tonic Craft CMS Versions up to 4.15.3 and 5.0.0 up to 5.7.5
Timeline
- 2025-05-28: disclosed: Initial vulnerability details shared by CISA
- 2025-06-02: advisory: NVD advisory published
- 2025-06-02: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2025-06-03: patched: Patches confirmed in versions 4.15.3 and 5.7.5