Bolt CMS EUVD-2025-19905

Exploitation requires an authenticated session with a valid Bolt backend account (PR:L) and depends on a specific multi-step chain: (1) the attacker must be able to edit their own user-profile displayname field, which backend templates render without sanitization; (2) the installation must expose the /async/browse/cache/.sessions and /async/folder/rename endpoints so cached .session files can be listed and renamed; and (3) the /files/ directory must be publicly web-accessible and able to serve/execute .php files, allowing a renamed session file to become a web shell. Limiting factors: valid credentials are mandatory (this is NOT unauthenticated), and it only affects Bolt CMS 3.7.0 and earlier - the 3.7.1 release specifically prevents renaming files to blacklisted filetypes, closing the chain. Because Bolt 3 is end-of-life, realistic risk is confined to legacy unpatched deployments.

This is a credentialed remote code execution flaw (CWE-94) in Bolt CMS ≤3.7.0, and the signals are mixed but lean toward genuine priority for anyone still running Bolt 3. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:P, VC:H/VI:H/VA:H, score 7.5) indicates a network-reachable attack that requires authentication (PR:L) plus specific attack preconditions (AT:P), with full confidentiality/integrity/availability impact on the vulnerable system and no scope change (SC:N). EPSS is notably high at 50.83% (98th percentile), and public exploit code is confirmed (Metasploit module and Exploit-DB 48296), so the exploitation probability and tooling maturity are strong corroborating signals of real-world usability. However, this is NOT CISA KEV-listed, so per the precision rules the correct characterization is 'publicly available exploit code exists' - do NOT treat it as confirmed active exploitation. The key tempering factors: the vulnerability requires valid low-privilege credentials (PR:L), and the product is end-of-life (Bolt 3 EOL after 31 December 2021) with a patched successor (3.7.1 / Bolt 4). The high EPSS reflects the age, public Metasploit coverage, and reliability of the exploit chain rather than evidence of mass active exploitation. Net: a real priority on exposed, authenticated Bolt 3.x instances, but the authentication requirement and EOL/low deployment footprint bound the blast radius versus an unauthenticated internet-wide bug.

An attacker who has obtained valid Bolt backend credentials (e.g., a low-privileged editor account via phishing or credential reuse) injects PHP into the user-profile displayname field, which backend templates render unsanitized. Using the public Metasploit module (exploit/unix/webapp/bolt_authenticated_rce), they list and rename a cached .session file into the public /files/ directory with a .php extension, then request that file over HTTP to execute the injected code as the web server user. A working, publicly available exploit makes this a low-effort attack against any reachable, credentialed Bolt 3.x install.