CVE-2025-35939

Craft CMS writes unauthenticated, user-controlled input — specifically the unsanitized return URL from a login-redirect request — into PHP session files stored at a predictable server location (/var/lib/php/sessions/sess_<session_value>), where the session value is disclosed to the client in the Set-Cookie header. Because the input is not sanitized, an unauthenticated network attacker can inject arbitrary content, including PHP code, into a known local file path on the server. That content can subsequently be accessed and potentially executed, likely by chaining this flaw with an independent vulnerability such as a local file inclusion, providing a path toward code execution. Any Craft CMS deployment running affected versions is exposed, and CISA added the issue to its Known Exploited Vulnerabilities catalog on 2025-06-02, indicating exploitation in the wild; EPSS currently estimates a ~1.3% probability of exploitation in the next 30 days.

What to do: Upgrade immediately to Craft CMS 5.7.5 (5.x branch) or 4.15.3 (4.x branch) or newer, per vendor guidance and the KEV/BOD 22-01 required actions for federal agencies. Inspect /var/lib/php/sessions for unexpected content or injected PHP in sess_* files and review web logs for unauthenticated requests supplying unsanitized return URLs; since execution likely depends on chaining with another flaw, also verify the instance is not exposed to related file-inclusion or local-file-access weaknesses.