CVE-2025-34086
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field, which is rendered unsanitized in backend templates. The attacker can then rename session files to a public path with a .php extension, creating a web shell. The vendor announced end-of-life for Bolt 3 after 31 December 2021.
Risk Assessment
An authenticated attacker could gain full control of the server, potentially leading to data theft, content modification, and further attacks on the infrastructure.
Recommendation
Immediately migrate to a supported version of Bolt CMS or switch to another system, as version 3.7.0 is no longer supported and will not receive fixes.
Other vulnerabilities in Bolt CMS
See all- CVE-2022-36532High
Bolt CMS version 5.1.12 and below contains a vulnerability that allows an authenticated user with ROLE_EDITOR privileges to upload and rename a malicious file, leading to remote code execution.
- CVE-2026-71291High
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twig flag and a regex, then compiles and renders the raw value without sandboxing.
- CVE-2026-11511Low
In Bolt CMS up to version 3.7.5, in the TextType.php file of the HTML Attribute Handler component, manipulation of the style argument leads to HTML injection. The attack is remote, exploit is public. The GitHub repository is archived and read-only, and the product is no longer supported.
- CVE-2026-39229Medium
Bolt CMS up to version 3.7.0 contains an SQL injection vulnerability in the 'order' parameter of content listing pages. An authenticated attacker with low privileges can exploit this via the OrderDirective component, allowing extraction of sensitive information.
- CVE-2021-40219High
Bolt CMS version 4.2 and earlier is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit the theme and inject server-side template injection, leading to remote code execution.
Original NVD description (English source)
Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file. NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS