CVE-2025-34086

Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file. NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.

• CWE-94
• CWE-434
• CWE-94

• https://boltcms.io/newsitem/major-announcements-bolt-3-eol-bolt-4-2-5-0-releasesRelease Notes
• https://github.com/bolt/boltProduct
• https://github.com/bolt/bolt/releases/tag/3.7.1Release Notes
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/bolt_authenticated_rce.rbExploit
• https://www.exploit-db.com/exploits/48296Exploit, VDB Entry
• https://www.rapid7.com/db/modules/exploit/unix/webapp/bolt_authenticated_rce/Exploit, Third Party Advisory

Published

Jul 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-34080The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable…6.1
• CVE-2025-34081The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP…7.5
• CVE-2025-34082A command injection vulnerability exists in IGEL OS versions…9.3
• CVE-2025-34083Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-34084Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-34085Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-34087An authenticated command injection vulnerability exists in P…8.8
• CVE-2025-34088An authenticated remote code execution vulnerability exists …8.8
• CVE-2025-34089An unauthenticated remote code execution vulnerability exist…9.3
• CVE-2025-3409A vulnerability classified as critical has been found in Not…8.8
• CVE-2025-34090Rejected reason: Neither filed by Chrome nor a valid securit…
• CVE-2025-34091Rejected reason: Neither filed by Chrome nor a valid securit…