Improper input validation in Craft CMS

1) Input validation error

EUVDB-ID: #VU110085

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2025-35939

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to write arbitrary contents to session files.

The vulnerability exists due to Craft CMS does not sanitize data before writing them into session files with predictable file names and location. A remote attacker can abuse this to write arbitrary PHP code into a known location of the system and later execute it using a different vulnerability.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Craft CMS: 4.0.0 - 5.7.4

CPE2.3

• cpe:2.3:a:pixel_and_tonic:craft_cms:4.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:pixel_and_tonic:craft_cms:4.0.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:pixel_and_tonic:craft_cms:4.0.1:*:*:*:*:*:*:*

External links

https://github.com/craftcms/cms/pull/17220
https://github.com/craftcms/cms/releases/tag/4.15.3
https://github.com/craftcms/cms/releases/tag/5.7.5
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json
https://www.cve.org/CVERecord?id=CVE-2025-35939

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.