VulnSocial

CVE-2025-35939General(craftcms / craft_cms)

LOWCVSS 5.3 · MEDIUMCISA KEV

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.

craftcms CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-06-23. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-472

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • craft_cms

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • General: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
craftcms
Products
craft_cms

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-03-12: 203-12
Signal classification1 categories
General
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-31859 Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs befo… https://www.cve.org/CVERecord?id=CVE-2026-31859 ----- Traducción: CVE-2026-31859 Cra… http://infoflow.cloud`

    Post summary

    The message references CVE‑2026‑31859 but offers no substantive information about exploitation, patches, or technical details.

    0000096
    57 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-31859 Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs befo… https://www.cve.org/CVERecord?id=CVE-2026-31859

    Post summary

    The excerpt merely references CVE-2026-31859 via a link, providing no details, exploit, or patch information.

    00000205
    56.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appcraftcmscraft_cms---

Explore more

Back to dashboardcraftcms CVEscraft_cms vulnerabilities