Browse / CVEs / CVE-2025-35939
CVE-2025-35939· craft cms / craft cms· CWE-472
Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
Exploited in the wild. Listed by CISA on 2025-06-02; known to be used by ransomware.
1.4%likelihood of exploitation, next 30 days
72%of all CVEs are less likely
Nonecheck to confirm it
Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.
No ready check is stored for this CVE. Confirm it by hand from the references.
References
Use this check only on systems you are authorised to test. Where the data comes from