CVE-2025-34086 affects Bolt CMS versions 3.7.0 and earlier. An authenticated user can inject arbitrary PHP code into the displayname field of their user profile, which is rendered without sanitization in backend templates. The attacker can then list and rename cached session files through specific endpoints, renaming a .session file to a .php file under the publicly accessible /files/ directory. This allows the injected PHP code to be executed as a web shell when accessed via a crafted HTTP GET request, resulting in remote code execution. The vulnerability chain involves improper control of code generation (CWE-94) and unsafe file handling (CWE-434). The vendor has declared Bolt 3 end-of-life as of December 31, 2021, and no patch or official fix is available.

An authenticated user with valid credentials can achieve remote code execution on affected Bolt CMS installations by exploiting this vulnerability. This can lead to full system compromise, unauthorized access, and execution of arbitrary code on the server hosting the CMS. Since the vulnerability requires authentication, the risk is limited to users who have valid login credentials. There are no known exploits in the wild as of the published date.

Bolt CMS version 3 has reached end-of-life as of December 31, 2021, and no official patch or fix is available for this vulnerability. Users are strongly advised to upgrade to a supported version of Bolt CMS that is not affected by this issue or migrate to an alternative CMS solution. Until then, restrict access to the CMS backend to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed due to end-of-life status; check vendor communications for any possible updates or community patches.