CVE-2025-35939: Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

CVE-2025-35939 is an external control of assumed-immutable web parameter vulnerability in Craft CMS. An unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. It can be chained with CVE-2024-58136 (as represented by CVE-2025-32432). This matters because successful abuse can place attacker-controlled content on the host, potentially enabling further compromise of the CMS and underlying server. Confirm all product and version details against the vendor advisory.

How it works

The flaw is classified as CWE-472: external control of an assumed-immutable web parameter. In this class of issue, the application treats certain request parameters as fixed or trusted when they are not. An attacker who can reach the vulnerable endpoint can supply values the server then writes or incorporates into a predictable local file path. The CISA summary states that unauthenticated clients can introduce arbitrary values, including PHP code, into a known local file location. That planted content can later be leveraged, especially when chained with the related issue noted above. Exact request parameters, file paths, and chaining steps are not detailed here; treat the vendor advisory as authoritative for mechanics and proof-of-concept status.

Am I affected? How to find it in your systems

Craft CMS is a content-management system commonly deployed for websites and digital experiences, often on Linux hosts running PHP and a web server such as Nginx or Apache, whether on-premises, in containers, or in cloud environments. Inventory every instance:

• Search configuration management, asset inventories, and package managers for Craft CMS installations.
• Inspect web roots, composer.lock or equivalent dependency files, and admin interfaces for the product and its version string.
• Review any publicly reachable Craft CMS sites, including staging and development copies that may still be exposed.

Because specific vulnerable version ranges are not supplied in the available facts, compare every discovered instance against the vendor advisory. Look for unexpected files appearing in known writable or predictable locations under the web root or application directories, anomalous unauthenticated POSTs or parameter-heavy requests in access logs, and sudden creation or modification of PHP files outside normal deployment processes. Telemetry that flags new files containing PHP tags in non-standard paths is especially useful.

How to remediate

Patch first. Apply the vendor-supplied update or mitigation instructions for Craft CMS as described in the official advisory. After patching, verify the version and re-test the previously vulnerable endpoints. Follow any additional vendor hardening steps and, for cloud-hosted instances, the applicable BOD 22-01 guidance. If mitigations are unavailable, discontinue use of the product as directed by CISA. Post-remediation, rotate any credentials or secrets that may have been present on the host and review file-system integrity for residual planted content.

If you can't patch immediately

Reduce exposure until the vendor update can be applied:

• Segment the Craft CMS hosts so they are reachable only from required networks; block unauthenticated internet access to the administrative and any parameter-accepting endpoints.
• Place a web application firewall or reverse-proxy virtual patch in front of the application to reject anomalous parameter values and requests that attempt to write or influence local file paths.
• Disable or tightly restrict any optional features or plugins that accept external parameters if the vendor indicates they are involved.
• Increase monitoring: alert on file-creation events under the web root, unexpected PHP files, and spikes in unauthenticated traffic to Craft CMS routes. Retain logs for forensic review.

These controls lower risk but do not replace the vendor patch. Confirm compensating measures against the advisory so they do not break legitimate functionality.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to unauthorized code execution and subsequent data access or ransomware staging, although ransomware use is not documented for this CVE. If compromise is suspected, isolate the host, preserve logs and disk images, and begin incident response. As a quick personal check, you can run a free exposure scan of your email address against known breach data to see whether credentials or personal information have already appeared in public dumps.