Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-35939

57
FAUCET Score

CVE-2025-35939 is a critical vulnerability affecting Craft CMS versions prior to 5.7.5 and 4.15.3. It allows unauthenticated attackers to inject arbitrary content, including PHP code, into server-side session files due to improper sanitization of return URLs. This vulnerability has a CVSS score of 5.3 (Medium) but a FAUCET Risk Score of 99/100, indicating a high potential impact, as it could lead to arbitrary code execution when combined with another vulnerability. Notably, this flaw is actively exploited in the wild, as confirmed by its presence in the KEV catalog, and has garnered significant community discussion, despite a lack of public exploit tools. Organizations using affected Craft CMS versions should prioritize immediate patching to mitigate this severe risk.

Impacted Technologies

VendorProductVersion(s)CPE
< 4.15.3CPE matchmatch criteria
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
>= 5.0.0, < 5.7.5CPE matchmatch criteria
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
>= 0, < 4.15.3CPE match
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
>= 0, < 5.7.5CPE match
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

6.9MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
LOW
VS Availability
NONE
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
1.27%
Probability of exploitation in next 30 days
EPSS Percentile
66.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
Added to KEV · Jun 2, 2025
This CVE's current EPSS score of 0.0127 is in the 42nd percentile among its peer group of 23,725 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

composerpatch availablevia ghsa
Product: craftcms/cmsFixed in: 5.7.5
composerpatch availablevia ghsa
Product: craftcms/cmsFixed in: 4.15.3
github_advisorypatch availablevia nvd_reference
View patch

Vendor Advisories (1)

composerGHSA-7vrx-9684-xrf2medium

Craft CMS stores arbitrary content provided by unauthenticated users in session files

May 8, 2025

References

cisa.gov / known-exploited-vulnerabilities-catalog
US Government Resource
github.com / craftcms/cms/pull/17220
Patch
github.com / craftcms/cms/releases/tag/4.15.3
Release Notes
github.com / craftcms/cms/releases/tag/5.7.5
Release Notes
raw.githubusercontent.com / cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json
Third Party Advisory
cve.org / CVERecord
VDB Entry