Craft CMS · Craft CMS
Craft CMS has a flaw in how it handles the return URL for login redirects: it stores the client-supplied URL in the server-side session file without sanitizing its parameters, letting attacker-controlled content end up in files under the PHP session directory. An unauthenticated remote attacker can exploit this over the network with no privileges or user interaction, simply by sending crafted requests that trigger the login redirect, with the attacker-supplied content then possibly executed through a separate, independent vulnerability.
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
First seen exploited 26 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
A fix was bypassed or incomplete once over 10 months. The latest fix listed for craftcms/cms is 5.8.21.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs before they are stored in the session.
This vulnerability allows an attacker to write arbitrary files to a known location on the target server, including potentially malicious files such as PHP scripts by leveraging the fact that Craft CMS creates session files for unauthenticated users at the login page. However, this vulnerability does not, by itself, cause any scripts to be executed or any information to be accessed, so it would need to be chained with another vulnerability in order to achieve code execution.
This vulnerability allows an attacker to write arbitrary files to a known location on the target server, including potentially malicious files such as PHP scripts by leveraging the fact that Craft CMS creates session files for unauthenticated users at the login page. However, this vulnerability does not, by itself, cause any scripts to be executed or any information to be accessed, so it can only write files and would need to be chained with another vulnerability in order to achieve code execution.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: craftcms/cms.
Upgrade to 5.7.5 or later
Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2024-56145, CVE-2025-23209, +1).
Set the version to 5.7.5 or later in your composer.json.
The first fix for CVE-2025-35939.
| If you run | Upgrade to |
|---|---|
| 5.0.0-alpha.1 up to 5.7.5 | 5.7.5 |
| All versions before 4.15.3 | 4.15.3 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.