# CVE-2025-34086: Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename

Status: published. Published: 2025-07-03. Updated: 2026-11-08.

Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file.

NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: VulnCheck) — https://github.com/bolt/bolt/releases/tag/3.7.1

## Affected products and versions

- Bolt / CMS (bolt/bolt): ≥ 0; ≤ 3.7.0 (affected, semver). Source: CNA: VulnCheck; platforms: Linux, x86, 64 bit

## Severity and prioritization

- CVSS 4.0: 7.5 (high); CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; source: CNA: VulnCheck

- CISA KEV: No listing in collected sources

- EPSS: 4.32% as of 2026-11-08; percentile 91.24%

- SSVC: exploitation none; automatable yes; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-94, CWE-434

## Exploit evidence

- exploit: https://www.exploit-db.com/exploits/48296 (CNA: VulnCheck)
- exploit: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/bolt_authenticated_rce.rb (CNA: VulnCheck)

## References

- https://github.com/bolt/bolt/releases/tag/3.7.1 (CNA: VulnCheck; vendor-advisory, patch, release-notes)

- https://www.exploit-db.com/exploits/48296 (CNA: VulnCheck; exploit)

- https://www.rapid7.com/db/modules/exploit/unix/webapp/bolt_authenticated_rce/ (CNA: VulnCheck; third-party-advisory)

- https://github.com/bolt/bolt (CNA: VulnCheck; product)

- https://boltcms.io/newsitem/major-announcements-bolt-3-eol-bolt-4-2-5-0-releases (CNA: VulnCheck; vendor-advisory)

- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/bolt_authenticated_rce.rb (CNA: VulnCheck; exploit)

## Provenance

- CNA: VulnCheck: https://www.cve.org/CVERecord?id=CVE-2025-34086; retrieved 2026-11-08; source updated 2026-11-08

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2025-34086; retrieved 2026-11-08; source updated Not reported

Revision: 4ee34ef289ad6e197ab3e6ad4e655b1cad89a37a1df85b5974e3cc9c1c83c745

Canonical: https://y2.dev/cve/CVE-2025-34086

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.