Craft CMS Session Poisoning to Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-35939)
Executive & SecOps Summary
SECOPS ASSESSMENTCraft CMS versions prior to 4.15.3 and 5.7.5
Unauthenticated attackers can inject arbitrary PHP code into session files, potentially leading to Remote Code Execution (RCE) when chained with an independent local file inclusion vulnerability.
Immediately upgrade Craft CMS to the patched versions (4.15.3, 5.7.5, or higher).
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security updates immediately. If you manage your dependencies via Composer, run the appropriate command below to upgrade to a secure version:
# For Craft CMS 5.x environments
composer update craftcms/cms:5.7.5 --with-dependencies
# For Craft CMS 4.x environments
composer update craftcms/cms:4.15.3 --with-dependencies2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, configure your Web Application Firewall (WAF) or reverse proxy to block requests containing PHP tags or suspicious payloads in query parameters. Below is an example Nginx configuration to mitigate the attack vector:
# Add inside the Nginx server block to block PHP tags in query strings
if ($query_string ~* '(<|%3C)\?php') {
return 403;
}
if ($query_string ~* 'redirect=.*(\?\||\<|\>)') {
return 403;
}3. Log Audit & IoC Verification Commands
Run the following commands on your server to inspect the PHP session directory for potential session poisoning attempts containing PHP code blocks:
# Search for PHP tags inside active PHP session files
sudo grep -r -E '<\?php|<\?' /var/lib/php/sessions/sess_*
# Verify the currently installed Craft CMS version
php craft helpBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability arises from how Craft CMS handles unauthenticated requests that require authentication. When redirecting a client to the login page, the application stores the client-provided return URL parameter in the PHP session file without proper sanitization. These session files are generated on the server at '/var/lib/php/sessions' and named 'sess_[session_value]', where the session value is exposed to the client via the 'Set-Cookie' response header.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker can initiate a request to an authenticated route while embedding malicious PHP code (e.g., <?php system($_GET['cmd']); ?>) inside the return URL parameter. Because Craft CMS writes this unsanitized parameter directly into the session file, the local session file becomes poisoned with executable PHP code. The attacker can then leverage a separate Local File Inclusion (LFI) vulnerability or directory traversal to include and execute the poisoned session file, achieving arbitrary code execution.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog. Successful exploitation allows remote attackers to execute arbitrary commands under the context of the web server process. This can lead to full system compromise, database credential theft, source code exfiltration, and lateral movement within the internal network, posing a severe threat to business continuity.
Official Vendor Advisories & References
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
Frequently Asked SecOps Questions (CVE-2025-35939)
FAQQ1. How critical is CVE-2025-35939 and is it actively exploited in the wild?
CVE-2025-35939 is rated CVSS 5.3 (MEDIUM) with a 30-day EPSS exploitation probability of 1.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-35939?
Primary impacted vendors include craftcms across craft_cms. Scope summary: Craft CMS 4.x (prior to 4.15.3) and 5.x (prior to 5.7.5)
Q3. What temporary mitigations or workarounds exist for CVE-2025-35939 before patching?
[Mitigation] Immediately upgrade Craft CMS to the patched versions (4.15.3, 5.7.5, or higher). Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-35939
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (craftcms)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.