VA-25-147-01: Craft CMS stores user-provided content session files

VA-25-147-01: Craft CMS stores user-provided content session files ↗ source

May 27, 2025 CISA Vulnerability Advisory

Source: https://github.com/cisagov/CSAF/blob/develop/csaf_files/IT/white/2025/va-25-147-01.json

Summary

Craft CMS stores user-provided content in session files. A remote, unauthenticated attacker can introduce arbitrary content, including PHP code, into session files with known names and locations. If an attacker can access these files, possibly through another vulnerability such as CVE-2024-58136 (or CVE-2025-32432). For context, Yii fixed CVE-2024-4990 then later re-introduced it as CVE-2024-58136. Craft CMS assigned CVE-2025-32432 to the Craft CMS inheritance of CVE-2024-58136. CVE-2025-35939: Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.

Advisory Details CISA IT CSAF feed

Advisory ID: VA-25-147-01
Status: Final · version 1.0.0
Initial release: 2025-05-28
Last revised: 2025-05-28
Vendor: Craft
Critical infrastructure sectors: Information Technology
Deployed: Worldwide
Vendor headquarters: United States

Craft has released CMS versions 5.7.5 and 4.15.3 to address this issue.

Affected products (1)

CMS — <5.7.5, 5.7.5, <4.15.3, 4.15.3

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVE	Weakness	CVSS v3	Details
CVE-2025-35939 KEV	CWE-472 External Control of Assumed-Immutable Web Parameter	5.3 Medium	Craft CMS stores user-provided content in session files Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue. CISA SSVC — Exploitation: Active · Automatable: Yes · Impact: Partial Vendor fix: Fixed in 5.7.5. ↗ Vendor fix: Fixed in 4.15.3. ↗ Affected, fixed & timeline Affected: CMS <5.7.5 CMS <4.15.3 Fixed in: CMS 5.7.5 CMS 4.15.3

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2025-35939	5.3 Medium	Craft CMS Craft CMS Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to …

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Craft CMS 4 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.