CVE-2025-34086: Boltcms Bolt RCE Vulnerability

CVE-2025-34086 Overview

CVE-2025-34086 is an authenticated remote code execution vulnerability affecting Bolt CMS versions 3.7.0 and earlier. The flaw chains PHP code injection in the user profile displayname field with session file manipulation through the /async/browse/cache/.sessions and /async/folder/rename endpoints. An authenticated attacker renames a cached session file containing injected PHP code into the public /files/ directory with a .php extension. Triggering the renamed file via an HTTP GET request executes the payload as a web shell. The vendor confirmed that Bolt 3 reached end-of-life after December 31, 2021, and will not receive further patches for this branch [CWE-94].

Critical Impact
Authenticated attackers can achieve remote code execution on Bolt CMS 3.x installations. A public Metasploit module and Exploit-DB entry exist, and the EPSS score of 67.402% places this in the 98th percentile of likely-exploited CVEs.

Affected Products

Bolt CMS versions 3.7.0 and earlier
Bolt 3.x branch (end-of-life after December 31, 2021)
Installations exposing the backend /async/ endpoints to authenticated users

Discovery Timeline

2025-07-03 - CVE-2025-34086 published to NVD
2025-09-16 - Last updated in NVD database

Technical Details for CVE-2025-34086

Vulnerability Analysis

The vulnerability is a multi-step exploitation chain rather than a single flaw. An attacker with valid backend credentials submits arbitrary PHP code in the displayname field of their user profile. Bolt CMS renders this field without sanitization in backend templates, causing the payload to be cached inside a PHP session file on the server.

The attacker then enumerates cached session files through the /async/browse/cache/.sessions endpoint. Using the /async/folder/rename endpoint, the attacker moves the session file to the publicly accessible /files/ directory and changes its extension to .php. A standard HTTP GET request to the relocated file forces the web server to interpret and execute the embedded PHP code.

Root Cause

The root cause is improper neutralization of user-supplied input written to template output combined with overly permissive backend file management endpoints. The displayname field is treated as trusted template data, and the /async/folder/rename endpoint does not restrict source paths, destination paths, or file extensions.

Attack Vector

Exploitation requires network access to the Bolt backend and valid authenticated credentials. The attack proceeds in four stages: inject PHP via profile update, enumerate session files, rename a session file to /files/<name>.php, and request the renamed file to execute the payload. Public exploit code is available through the Rapid7 Bolt Authenticated RCE Module and Exploit-DB #48296. See the Metasploit module source for the full exploitation sequence.

Detection Methods for CVE-2025-34086

Indicators of Compromise

PHP files appearing under the web-accessible /files/ directory with names matching session identifier patterns
HTTP POST requests to /async/folder/rename where the source path references app/cache/.sessions or destination ends in .php
HTTP GET requests to /async/browse/cache/.sessions from authenticated backend users
User profile updates containing PHP tags (<?php, <?=) in the displayname field

Detection Strategies

Inspect web server access logs for sequential requests to /async/browse/cache/.sessions, /async/folder/rename, and /files/*.php
Monitor the application database or profile change events for displayname values containing PHP syntax or HTML script delimiters
Alert on creation of .php files in directories that should only contain user-uploaded media

Monitoring Recommendations

Enable file integrity monitoring on the Bolt /files/ and app/cache/.sessions directories
Forward web server and application logs to a centralized SIEM for correlation across the four-stage attack chain
Track authentication events for Bolt backend users and review accounts that perform profile edits followed by file operations

How to Mitigate CVE-2025-34086

Immediate Actions Required

Migrate off Bolt 3.x to a supported Bolt 4.x or 5.x release, as Bolt 3 is end-of-life and will not receive a patch for this issue
Audit all backend user accounts and remove unused or stale credentials that could be leveraged for authenticated exploitation
Block external access to the /async/ administrative endpoints using a reverse proxy or web application firewall
Scan the /files/ directory for unauthorized .php files and remove any artifacts of prior exploitation

Patch Information

No security patch is available for the Bolt 3.x branch. According to the BoltCMS Major Announcements, Bolt 3 reached end-of-life after December 31, 2021. The Bolt 3.7.1 release does not remediate this chain. Operators should upgrade to a currently supported major version.

Workarounds

Configure the web server to refuse PHP execution within the /files/ directory using directives such as php_flag engine off or an Nginx location block that disables the PHP handler
Restrict access to the Bolt backend (/bolt/ and /async/) by source IP through firewall or reverse proxy rules
Enforce strong, unique passwords and multi-factor authentication on all backend accounts to raise the bar for the authenticated prerequisite
Set file system permissions so the web server user cannot write .php files into web-accessible upload directories

bash

# Nginx: disable PHP execution inside the public /files/ directory
location ^~ /files/ {
    location ~ \.php$ {
        return 403;
    }
}

# Apache: equivalent restriction via .htaccess in /files/
# <FilesMatch "\.php$">
#     Require all denied
# </FilesMatch>