Reference page — cumulative record through Monday, October 5, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N N L N 6.9 .0135 70.5 YES
AFFECTED Product Versions Fixed CMS unspecified 5.7.5
TIMELINE Apr 15 Reserved by cisa-cg May 7 Published (CNA: cisa-cg) Jun 2 Added to CISA KEV, remediation due 2025-06-23
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
| Date | Event | Detail |
|---|---|---|
| April 15, 2025 | Reserved | Reserved by cisa-cg |
| May 7, 2025 | Published | Published (CNA: cisa-cg) |
| June 2, 2025 | KEV ADDED | Added to CISA KEV, remediation due 2025-06-23 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Craft | CMS | — | — | 5.7.5 |
Authoritative record: CVE-2025-35939 at cve.org
Vendors: craft
Weaknesses: CWE-472
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-35939 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 5, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
