CVE-2025-34086: Bolt CMS Authenticated Remote Code Execution Vulnerability
Summary
CVE-2025-34086: Bolt CMS vulnerable to authenticated remote code execution. Affects bolt/bolt versions < 3.7.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bolt CMS is an open-source content management system designed for ease of use and flexibility. It allows users to create and manage websites with a focus on simplicity and user-friendly interfaces. However, versions 3.7.0 and earlier of Bolt CMS are vulnerable to a critical security flaw that can be exploited by authenticated users to execute arbitrary PHP code.
Vulnerability Detail
Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. This allows an attacker to list and rename cached session files via specific endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can create an executable web shell. The payload can then be triggered via a crafted HTTP GET request to the rogue file, leading to severe security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the backend of your Bolt CMS installation to trusted IP addresses only, thereby reducing the risk of exploitation. Additionally, consider sanitizing user input in the displayname field to prevent code injection.
Conclusion
The vulnerability identified as CVE-2025-34086 poses a significant risk to users of Bolt CMS versions 3.7.0 and earlier. It is crucial to update to a patched version to mitigate the risk of remote code execution. Additionally, implementing workarounds can help reduce exposure until the update is applied.
See every vulnerability recorded for bolt/bolt →
FAQ
CVE-2025-34086 is a vulnerability in Bolt CMS that allows authenticated users to execute arbitrary PHP code remotely.
If you are using Bolt CMS version 3.7.0 or earlier, your installation is vulnerable. You can check your version in the admin panel or by looking at the composer.lock file.
An attacker can gain unauthorized access to your server, execute arbitrary code, and potentially compromise sensitive data.
Yes, updating to a version later than 3.7.0 will patch this vulnerability.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the composer.lock file. You can also check your application for vulnerabilities using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for bolt/bolt.
