CVE-2025-35939
Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
Description
CVE-2025-35939 is a medium-severity vulnerability in Craft CMS that allows unauthenticated attackers to inject arbitrary content, including PHP code, into server-side session files through unsanitized URL parameters. The flaw exists because Craft CMS stores the return URL from unauthenticated requests in PHP session files without sanitization, enabling an attacker to write arbitrary values to a known file path on the server (/var/lib/php/sessions/sess_[session_value]). While the vulnerability alone results in file content injection (CVSS v3.1 score 5.3, MEDIUM), it could potentially be combined with a separate local file inclusion vulnerability to achieve code execution. CISA has added CVE-2025-35939 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 20.81% at the 95.49th percentile indicates very high exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| craftcms | craft cms | < 4.15.3; >= 5.0.0, < 5.7.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://github.com/craftcms/cms/pull/17220(Patch)
- https://github.com/craftcms/cms/releases/tag/4.15.3(Release Notes)
- https://github.com/craftcms/cms/releases/tag/5.7.5(Release Notes)
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json(Third Party Advisory)
- https://www.cve.org/CVERecord?id=CVE-2025-35939(VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939(US Government Resource)
Weakness Type
CWE-472: External Control of Assumed-Immutable Web Parameter
CVE-2025-35939 is classified under CWE-472 (External Control of Assumed-Immutable Web Parameter), which occurs when a web application trusts client-supplied data that the developer assumes cannot be modified. In Craft CMS, the application stores the return URL from unauthenticated HTTP requests in session files without sanitization, assuming that URL parameters would contain only legitimate URL paths. However, an attacker can inject arbitrary content—including PHP code—into these session files by manipulating the return URL parameter.
Learn more: CWE-472 — External Control of Assumed-Immutable Web Parameter
Impact Analysis
CVE-2025-35939 has a moderate direct impact with a CVSS score of 5.3, but its practical risk is amplified by the potential for exploit chaining. The vulnerability is network-accessible (AV:N) with low complexity (AC:L), requiring no authentication (PR:N) or user interaction (UI:N). Integrity (Low): The direct impact is the ability to inject arbitrary content into server-side session files. While this alone does not constitute code execution, the attacker can write PHP code into a file at a predictable path on the server. If combined with a local file inclusion vulnerability (either in Craft CMS or another application on the same server), this injected PHP code could be executed, escalating the impact to full remote code execution. The EPSS score of 20.81% at the 95.49th percentile is notably high for a medium-severity vulnerability, indicating that attackers are actively exploiting this flaw in combination with other vulnerabilities to achieve more severe outcomes than the CVSS score alone suggests.
Exploit Maturity
CVE-2025-35939 demonstrates high exploit maturity despite its medium CVSS score. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog, and the EPSS score of 20.81% at the 95.49th percentile places it among the top 4.5% of all vulnerabilities by exploitation probability. The CISA CSAF advisory provides additional technical context on the exploitation patterns. This vulnerability is particularly concerning because it is being actively exploited in combination with other Craft CMS vulnerabilities—notably CVE-2024-56145, a code injection flaw—to achieve full remote code execution through a chained attack that first injects PHP code into session files and then triggers its execution.
Remediation
-
Update Craft CMS immediately to version 5.7.5 (for 5.x installations) or version 4.15.3 (for 4.x installations). These versions sanitize the return URL parameter before storing it in session files, preventing arbitrary content injection.
-
Review PHP session file directories (
/var/lib/php/sessions/) for evidence of injection. Look for session files containing PHP code, shell commands, or other suspicious content that should not be present in legitimate session data. -
Implement web application firewall (WAF) rules to detect and block requests containing PHP code or shell commands in URL parameters. Filter for common injection patterns such as
<?php,system(,eval(, and other PHP function calls in query string parameters. -
Audit server-side file inclusion configurations to ensure that PHP's
includeandrequirefunctions cannot be used to load session files. Configureopen_basedirrestrictions and disable dangerous PHP functions (eval,system,exec) where possible. -
Conduct a comprehensive security assessment of the Craft CMS deployment to identify any additional vulnerabilities that could be chained with this session injection flaw. Pay particular attention to local file inclusion vectors and ensure PHP's
register_argc_argvsetting is disabled.
Technical Details
CVE-2025-35939 exploits the session handling mechanism in Craft CMS. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N reflects network-accessible exploitation with no prerequisites and low integrity impact. When an unauthenticated user requests a page that requires authentication, Craft CMS redirects to the login page and stores the original requested URL in a PHP session file at /var/lib/php/sessions/sess_[session_value], where the session value is provided to the client via a Set-Cookie response header. The vulnerability exists because Craft CMS does not sanitize the return URL parameters before writing them to the session file. An attacker can craft a request with arbitrary content in the URL parameters, such as embedded PHP code, which is then written verbatim to a session file at a predictable server-side path. The attacker knows both the file path and name because the session identifier is returned in the cookie. This creates a primitive for writing arbitrary content to a known location on the server, which becomes a critical attack vector when combined with file inclusion vulnerabilities.
Frequently Asked Questions
Is CVE-2025-35939 being actively exploited?
Yes. Despite its medium CVSS score, CVE-2025-35939 is actively exploited according to CISA's KEV catalog. The EPSS score of 20.81% at the 95.49th percentile indicates very high exploitation activity, likely in combination with other vulnerabilities.
What products are affected by CVE-2025-35939?
Craft CMS versions prior to 4.15.3 (4.x branch) and versions 5.0.0 through 5.7.4 (5.x branch) are affected. Any Craft CMS deployment accessible from the network is potentially vulnerable.
How do I fix CVE-2025-35939?
Update Craft CMS to version 4.15.3 or 5.7.5 immediately. Review PHP session directories for evidence of code injection and implement WAF rules to block malicious URL parameters.
How severe is CVE-2025-35939?
CVE-2025-35939 has a CVSS score of 5.3 (MEDIUM) for the standalone vulnerability, but its real-world severity is significantly higher when chained with other vulnerabilities such as CVE-2024-56145. The very high EPSS score confirms that attackers are actively leveraging this flaw.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.