GHSA-7vrx-9684-xrf2
First published: Thu May 08 2025(Updated: )
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at `/var/lib/php/sessions`. Such session files are named `sess_[session_value]`, where `[session_value]` is provided to the client in a `Set-Cookie` response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/craftcms/cms | <4.15.3 | 4.15.3 |
| composer/craftcms/cms | >=5.0.0-alpha.1<5.7.5 | 5.7.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2025-35939
- https://github.com/craftcms/cms/pull/17220
- https://github.com/craftcms/cms/releases/tag/4.15.3
- https://github.com/craftcms/cms/releases/tag/5.7.5
- https://github.com/craftcms/cms/commit/e4c7bac8f31010aee048409f9ef6f744a83146b2
- https://github.com/advisories/GHSA-7vrx-9684-xrf2 (Advisory)
Frequently Asked Questions
What is the severity of GHSA-7vrx-9684-xrf2?
GHSA-7vrx-9684-xrf2 is classified as a moderate severity vulnerability that can be exploited to access and execute arbitrary content.
How do I fix GHSA-7vrx-9684-xrf2?
To fix GHSA-7vrx-9684-xrf2, update Craft CMS to version 4.15.3 or 5.7.5 or later.
What systems are affected by GHSA-7vrx-9684-xrf2?
GHSA-7vrx-9684-xrf2 affects Craft CMS versions prior to 4.15.3 and from 5.0.0-alpha.1 to 5.7.5.
Can unauthenticated users exploit GHSA-7vrx-9684-xrf2?
Yes, unauthenticated users can provide arbitrary content that could lead to exploitation of GHSA-7vrx-9684-xrf2.
What are the risks of not addressing GHSA-7vrx-9684-xrf2?
Failing to address GHSA-7vrx-9684-xrf2 opens the door to potential unauthorized access and execution of malicious content.
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-7vrx-9684-xrf2
- alias/CVE-2025-35939
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/references
- agent/weakness
- agent/source
- agent/tags
- agent/type
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/event
- package-manager/composer