Craft CMS Remote Code Execution via PHP Injection (CVE-2025-35939)

Historical catalog analysis: CISA added this entry on June 02, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-35939 is a vulnerability in Craft CMS involving the external control of an assumed-immutable web parameter (CWE-472). This flaw allows an unauthenticated remote attacker to introduce arbitrary values, specifically PHP code, into a known local file location on the server. Because this can lead to remote code execution (RCE), it represents a high-severity exposure. The source also notes that this vulnerability could be chained with CVE-2024-58136, as represented by CVE-2025-32432.

Exposure and applicability

This vulnerability affects organizations deploying Craft CMS. The primary exposure path is the web interface, where an unauthenticated client can manipulate a parameter that the application incorrectly assumes to be immutable. This allows for the placement of malicious PHP code on the server’s filesystem. Infrastructure owners should identify all public-facing and internal instances of Craft CMS to determine their current exposure level.

Remediation priorities

Based on our analysis, defenders should prioritize the following actions to reduce exposure:

1. Apply Vendor Mitigations: The primary corrective action is to implement the mitigations provided by the vendor. This is the most direct method to close the PHP injection path.
2. Assess Chaining Risks: Because CVE-2025-35939 can be chained with other vulnerabilities (such as CVE-2024-58136), security teams should evaluate if multiple unpatched flaws exist in their environment, as this could increase the ease or impact of an exploit.
3. Evaluate Product Viability: In scenarios where vendor mitigations cannot be applied or are unavailable for a specific deployment, the source suggests discontinuing use of the product to eliminate the risk entirely.

How to validate remediation

Verification must go beyond confirming a version number. To ensure that exposure has been reduced, vulnerability management teams should focus on the following:

• Configuration Audit: Verify that the specific web parameters identified in the vendor’s mitigation guidance are no longer susceptible to external manipulation.
• Filesystem Integrity Check: Monitor known local file locations for unauthorized changes or the presence of unexpected PHP code, which would indicate a failed mitigation or an existing compromise.
• Functional Testing: In a staged environment, attempt to introduce non-malicious arbitrary values via the affected parameter to confirm that the application now correctly treats the parameter as immutable.

Limits and open questions

A version check alone does not prove that the PHP injection path is closed or that the server has not already been compromised. There remains residual risk if the vulnerability was chained with other flaws before mitigations were applied. Additionally, while CISA has added this to the Known Exploited Vulnerabilities catalog, it is currently unknown if this specific flaw is being utilized by ransomware campaigns.

Source and editorial note

CVE-2025-35939: Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability · Source date: June 02, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: June 05, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 13, 2026 at 00:20 UTC.

Request a Vulnerability Assessment