PT-2025-27826 · Bolt Cms · Bolt Cms

Sivanesh Ashok · Published 2025-07-03 · Updated 2025-09-16 · CVE-2025-34086

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bolt CMS versions 3.7.0 and earlier

Description: The issue allows an authenticated user to achieve remote code execution. This is done by injecting arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can list and rename cached session files via the "/async/browse/cache/.sessions" and "/async/folder/rename" endpoints. By renaming a .session file to a path under the publicly accessible "/files/" directory with a .php extension, the attacker can turn the injected code into an executable web shell. The attacker then triggers the payload via a crafted HTTP GET request to the rogue file.

Recommendations: For Bolt CMS versions 3.7.0 and earlier, consider updating to a version that is still supported, as Bolt 3 reached end-of-life after 31 December 2021. As a temporary workaround, consider restricting access to the "/async/browse/cache/.sessions" and "/async/folder/rename" endpoints to minimize the risk of exploitation. Avoid using the displayname field in user profiles until the issue is resolved. Restrict access to the "/files/" directory to prevent execution of malicious PHP code.

Exploit

Fix

RCE

Code Injection

Unrestricted File Upload

Weakness Enumeration

CWE-94

CWE-434

Related Identifiers

CVE-2025-34086

GHSA-P9QC-8JJX-G8CG

Affected Products

Bolt Cms

References · 14

• 🔥 https://rapid7.com/db/modules/exploit/unix/webapp/bolt_authenticated_rce · Exploit
• 🔥 https://exploit-db.com/exploits/48296 · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/bolt_authenticated_rce.rb · Exploit
• https://osv.dev/vulnerability/CVE-2025-34086 · Vendor Advisory
• https://boltcms.io/newsitem/major-announcements-bolt-3-eol-bolt-4-2-5-0-releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34086 · Security Note
• https://osv.dev/vulnerability/GHSA-p9qc-8jjx-g8cg · Vendor Advisory
• https://github.com/bolt/bolt/releases/tag/3.7.1 · Patch, Vendor Advisory
• https://github.com/bolt/bolt/blob/3.7/src/Controller/Backend/Users.php#L279-L311 · Note
• https://github.com/bolt/bolt · Note
• https://t.me/cvenotify/127660 · Telegram Post
• https://t.me/cveNotify/135584 · Telegram Post
• https://twitter.com/SecAideInfo/status/1941803116703490503 · Twitter Post
• https://twitter.com/CVEnew/status/1940876704270147642 · Twitter Post