Craft CMS stores arbitrary content provided by unauthenticated users in session filesGHSA-7vrx-9684-xrf2
MEDIUMFix: craftcms/cms#17220GHSA-7vrx-9684-xrf2 is a medium-severity (CVSS 5.3) CWE-472 vulnerability in craftcms/cms. It is in CISA's Known Exploited Vulnerabilities catalog (added 2025-06-02) — treat it as actively exploited and patch now. A fix is available for craftcms/cms — see the affected versions and patch details below.
Exploitation Status
Actively exploited in the wild
- Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2025-06-02. Federal agencies were required to remediate by 2025-06-23.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA (KEV catalog and SSVC triage) for GHSA-7vrx-9684-xrf2.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-7vrx-9684-xrf2 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
craftcms/cms🐘craftcms/cmsReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at /var/lib/php/sessions. Such session files are named sess_[session_value], where [session_value] is provided to the client in a Set-Cookie response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | craftcms/cms | ≥ 5.0.0-alpha.1&&< 5.7.5 | 5.7.5composer require craftcms/cms:^5.7.5 |
| 🐘Packagist | craftcms/cms | all versions | 4.15.3composer require craftcms/cms:^4.15.3 |
Affected Products
craft cmscraftcmsDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for craftcms/cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update craftcms/cms to 5.7.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7vrx-9684-xrf2 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is GHSA-7vrx-9684-xrf2 in your dependencies?
Find it across Packagist, including transitive dependencies.