CVE-2025-35939: Craft CMS unauthenticated session file write enables PHP code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is unauthenticated and network-reachable, and CISA KEV listing confirms active exploitation, though it requires chaining with a separate vulnerability to achieve code execution.

What it is

Craft CMS stores unsanitized client-supplied return URL values in server-side session files for unauthenticated users. Because the session file path is predictable and the content is attacker-controlled, PHP code can be written to a known local file location. This matters because it creates a local file inclusion or execution primitive that can be chained with an independent vulnerability to run code.

Impact

An unauthenticated attacker can plant arbitrary PHP code in a known session file on the server. If combined with a separate file inclusion or execution flaw, this yields remote code execution on the Craft CMS host.

Attack surface

Reachable over the network with no authentication and no user interaction, per the CVSS 4.0 vector AV:N/PR:N/UI:N. The attacker simply triggers a redirect to the login page and controls the return URL parameter that gets written into the session file.

Exploitation

CVE-2025-35939 is listed in CISA KEV with a due date of 2025-06-23, indicating known exploitation in the wild. EPSS 30-day probability is 0.01317 (69th percentile), so mass scanning is not strongly indicated, but KEV status confirms real-world use.

What to do

• Upgrade Craft CMS to 5.7.5 or 4.15.3, which contain the fix.
• Apply the vendor patch referenced in PR 17220 if an immediate upgrade is not possible.
• Restrict or monitor access to the PHP session directory (/var/lib/php/sessions) and ensure session files are not web-accessible.
• Review and harden any file inclusion or template rendering paths that could read session files.
• Follow CISA BOD 22-01 guidance for cloud services or discontinue use if mitigations cannot be applied.

Detection

• Monitor session files in /var/lib/php/sessions for unexpected PHP tags or code-like content.
• Alert on requests that set return URL parameters containing PHP code or unusual characters.
• Watch for chained exploitation attempts that read or include session files via other application endpoints.
• Audit web server logs for unauthenticated redirect requests with attacker-controlled return URL values.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.