CVE-2025-34086: CWE-94 Improper Control of Generation of Code ('Code Injection') in Bolt CMS
Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file. NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.
AI Analysis
Technical Summary
CVE-2025-34086 is a high-severity vulnerability in Bolt CMS (version 3.7.0 and earlier) involving improper control of code generation (CWE-94). An authenticated user can inject PHP code into the displayname field, which is rendered without sanitization in backend templates. The attacker can then rename cached session files to place the injected code as a .php file in a publicly accessible directory (/files/), effectively creating a web shell. This chain of vulnerabilities enables remote code execution triggered by a crafted HTTP GET request. Bolt CMS version 3 is end-of-life, and no official patch or fix is provided by the vendor.
Potential Impact
An attacker with valid credentials can achieve remote code execution on the affected Bolt CMS server by injecting PHP code and manipulating session files to deploy a web shell. This compromises the confidentiality, integrity, and availability of the system. The vulnerability requires authentication but allows high-impact control over the server.
Mitigation Recommendations
Bolt CMS version 3 has reached end-of-life and no official patch is available. Users are advised to upgrade to a supported version of Bolt CMS that does not contain this vulnerability. If upgrading is not immediately possible, restrict access to the backend to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed by the vendor due to end-of-life status; check vendor communications for any possible backports or mitigations.
CVE-2025-34086: CWE-94 Improper Control of Generation of Code ('Code Injection') in Bolt CMS
Description
Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file. NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.
CVSS v4.0
Score 7.5high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-34086 is a high-severity vulnerability in Bolt CMS (version 3.7.0 and earlier) involving improper control of code generation (CWE-94). An authenticated user can inject PHP code into the displayname field, which is rendered without sanitization in backend templates. The attacker can then rename cached session files to place the injected code as a .php file in a publicly accessible directory (/files/), effectively creating a web shell. This chain of vulnerabilities enables remote code execution triggered by a crafted HTTP GET request. Bolt CMS version 3 is end-of-life, and no official patch or fix is provided by the vendor.
Potential Impact
An attacker with valid credentials can achieve remote code execution on the affected Bolt CMS server by injecting PHP code and manipulating session files to deploy a web shell. This compromises the confidentiality, integrity, and availability of the system. The vulnerability requires authentication but allows high-impact control over the server.
Mitigation Recommendations
Bolt CMS version 3 has reached end-of-life and no official patch is available. Users are advised to upgrade to a supported version of Bolt CMS that does not contain this vulnerability. If upgrading is not immediately possible, restrict access to the backend to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed by the vendor due to end-of-life status; check vendor communications for any possible backports or mitigations.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2025-04-15T19:15:22.551Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6866dff66f40f0eb729b6244
Added to database: 07/03/2025, 19:54:30 UTC
Last enriched: 05/16/2026, 09:15:55 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 208
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.