CVE-2025-35939
📋 TL;DR
CVE-2025-35939 is a session file injection vulnerability in Craft CMS where unauthenticated users can inject arbitrary content into server-side session files. This could lead to remote code execution if combined with another vulnerability to access and execute the injected content. Affects Craft CMS installations before versions 5.7.5 and 4.15.3.
💻 Affected Systems
- Craft CMS
📦 What is this software?
Craft Cms by Craftcms
Craft Cms by Craftcms
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, and lateral movement within the network.
Likely Case
Session file corruption, denial of service, or preparation for future exploitation if combined with other vulnerabilities.
If Mitigated
Limited impact with proper session file permissions and web server isolation preventing file execution.
🎯 Exploit Status
Requires chaining with another vulnerability to execute injected content, but injection itself is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.7.5 or 4.15.3
Vendor Advisory: https://github.com/craftcms/cms/releases/tag/5.7.5
Restart Required: No
Instructions:
1. Backup your Craft CMS installation and database. 2. Update to Craft CMS 5.7.5 (for Craft 5) or 4.15.3 (for Craft 4). 3. Verify update via admin panel. 4. Clear PHP session files at /var/lib/php/sessions/.
🔧 Temporary Workarounds
Restrict Session File Permissions
linuxSet strict permissions on PHP session directory to prevent file execution.
chmod 600 /var/lib/php/sessions/*
chown www-data:www-data /var/lib/php/sessions/
Session Storage Isolation
allMove session storage outside web root or use database session storage.
Edit php.ini: session.save_path = "/var/php_sessions"
mkdir /var/php_sessions && chmod 700 /var/php_sessions
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block suspicious session parameter patterns.
- Monitor and alert on unusual session file modifications in /var/lib/php/sessions/.
🔍 How to Verify
Check if Vulnerable:
Check Craft CMS version in admin panel or via composer show craftcms/cms. Versions below 5.7.5 (Craft 5) or 4.15.3 (Craft 4) are vulnerable.Check Version:
composer show craftcms/cms | grep versionVerify Fix Applied:
Confirm version is 5.7.5 or higher (Craft 5) or 4.15.3 or higher (Craft 4). Test that session parameters are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual session file creation/modification timestamps in /var/lib/php/sessions/
- HTTP requests with suspicious parameters in return URLs
Network Indicators:
- HTTP requests containing PHP code patterns in URL parameters
- Multiple session creation attempts from single IP
SIEM Query:
source="/var/log/nginx/access.log" OR source="/var/log/apache2/access.log" | search "returnUrl=*php*" OR "returnUrl=*eval*" OR "returnUrl=*system*"🔗 References
- https://github.com/craftcms/cms/pull/17220
- https://github.com/craftcms/cms/releases/tag/4.15.3
- https://github.com/craftcms/cms/releases/tag/5.7.5
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json
- https://www.cve.org/CVERecord?id=CVE-2025-35939
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939
