Actively exploited in the wild
Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
Craft CMS - Craft CMS · Listed in the CISA KEV since 2025-06-02. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-35939
MediumCVSS 5.3KEVSummary
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
Risk Assessment
The ability to inject PHP code into session files can lead to remote code execution and full compromise of the Craft CMS server.
Recommendation
Update Craft CMS to version 5.7.5 or 4.15.3 (or later) to address the vulnerability.
Other vulnerabilities in Craft CMS
See all- CVE-2026-92594High
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorizes the GraphQL draftCreator and revisionCreator fields. Instead of requiring the user-data scope enforced by Gql::canQueryUsers(), these fields are gated only on elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element without per-field authorization. A client with only those scopes can harvest email addresses, usernames, full names, and postal addresses of all draft/revision creators. Fixed in 5.11.0.
- CVE-2026-92593High
Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml(). Because Craft/Yii HMAC tokens are not bound to a parameter name, an authenticated low-privilege control panel user with edit rights on a single element type can mint a token over attacker-controlled Twig for the returnUrl parameter and replay it as the redirect POST parameter, reaching the unsandboxed sink and achieving server-side template injection that executes arbitrary PHP code. The issue is fixed in 5.10.13.
- CVE-2026-92592High
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose. An authenticated, non-administrator user can set the cookie via the license-shun endpoint and transplant the signed envelope into the redirect parameter; on a successful login, Craft validates the signature and renders the authenticated bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and allows PHP system() to execute arbitrary operating-system commands as the web-server user. Exploitation requires an account using password authentication without active 2FA, the default request configuration, and availability of PHP system(). The issue is fixed in 4.18.6 and 5.10.13.
- CVE-2026-92591Medium
Craft CMS versions 5.0.0 through 5.10.12 treat a database connection failure as meaning Craft is not installed, making anonymous installer actions (including install/validate-site) reachable on an installed production site when PHP remains available but MySQL is not. An authenticated attacker with a valid guest session and CSRF token can read environment variables, including the security key, database credentials, or API keys. Fixed in 5.10.13.
- CVE-2026-92590Medium
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticated Control Panel sessions of higher-privileged users. Fixed in 5.10.13.
- CVE-2026-92589Medium
Craft CMS 5.0.0 through 5.10.12 contains a broken access control flaw in the nested-elements reorder endpoint. An authenticated user with view-only permissions can reorder Matrix blocks or Address fields in another author's content without save access.
- CVE-2026-84802Medium
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.
- CVE-2026-84801High
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL and set a new password, enabling complete control-panel takeover.
- CVE-2026-84800High
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the replacePeerFiles permission is never enforced, allowing an authenticated low-privilege author with replaceFiles permission to overwrite peer asset files.
- CVE-2026-84798High
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method checks permissions only against the user's own provisional draft, then deletes the canonical element without re-checking, allowing an authenticated user without deleteEntriesForSite permission to hard-delete entries.
Original NVD description (English source)
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.