Threat intelligence / Vulnerability
CVE-2025-35939
Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.
Vulnerability
TypeVulnerability
External ID—
First seen2025-06-02
Last seen2025-06-02
Confidence
—
Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.
Labels
CISA KEV context
Vendor / productCraft CMS Craft CMS
Added2025-06-02
Due date2025-06-23
5 recorded
Relationships
2 external