CVE-2015-7309

CVE-2015-7309 describes an arbitrary code execution vulnerability in the theme editor of Bolt CMS versions prior to 2.2.5. An authenticated attacker can exploit this by renaming a crafted file to bypass file extension checks, then directly accessing the renamed file. With a CVSS score of 6.5, this vulnerability is moderately severe, allowing for partial confidentiality, integrity, and availability impact with low attack complexity. While not on the KEV catalog, exploit modules are publicly available in Metasploit and ExploitDB, indicating a clear path for exploitation, though there is no evidence of active exploitation or significant community discussion.