Boltcms
Boltcms Bolt: vulnerabilities and CVEs
Boltcms Bolt has 19 published vulnerabilities, 0 of them in the last 12 months. 1 are rated critical and 0 are listed by CISA as actively exploited.
CVEs19
Last 12 months0
Critical1
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-34086 | High (7.5) | 3.6% | — | Jul 3, 2025 | Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the… |
| CVE-2024-7300 | Medium (5.3) | 0.40% | — | Jul 31, 2024 | A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/showcases of the component Showcase Creation Handler. The manipulation of the… |
| CVE-2024-7299 | Medium (5.3) | 0.39% | — | Jul 31, 2024 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Bolt CMS 3.7.1. It has been rated as problematic. This issue affects some unknown processing of the file /preview/page of the component Entry Preview Handler.… |
| CVE-2022-31321 | Critical (9.1) | 0.85% | — | Aug 1, 2022 | The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform directory enumeration or cause a Denial of Service (DoS) via a crafted input. |
| CVE-2021-27367 | High (7.5) | 1.7% | — | Feb 17, 2021 | Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal. |
| CVE-2020-28925 | Medium (5.3) | 1.1% | — | Dec 30, 2020 | Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Your PHP for Better Security" guidance. |
| CVE-2020-4041 | Medium (6.1) | 2.0% | — | Jun 8, 2020 | In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded,… |
| CVE-2020-4040 | Medium (4.3) | 1.8% | — | Jun 8, 2020 | Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content… |
| CVE-2019-9553 | Medium (6.1) | 1.8% | — | Dec 31, 2019 | Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933. |
| CVE-2019-20058 | Medium (6.1) | 0.70% | — | Dec 29, 2019 | Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the _profiler page. NOTE: this is disputed because profiling was never intended for use in production. This is… |
| CVE-2019-15485 | Medium (6.1) | 0.86% | — | Aug 23, 2019 | Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php. |
| CVE-2019-15484 | Medium (6.1) | 0.86% | — | Aug 23, 2019 | Bolt before 3.6.10 has XSS via an image's alt or title field. |
| CVE-2019-15483 | Medium (6.1) | 0.86% | — | Aug 23, 2019 | Bolt before 3.6.10 has XSS via a title that is mishandled in the system log. |
| CVE-2019-10874 | High (8.8) | 4.5% | — | Apr 5, 2019 | Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the… |
| CVE-2019-9185 | High (8.8) | 2.7% | — | Mar 7, 2019 | Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension. |
| CVE-2017-16754 | Medium (5.3) | 1.8% | — | Nov 10, 2017 | Bolt before 3.3.6 does not properly restrict access to _profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php. |
| CVE-2017-11128 | Medium (5.4) | 0.55% | — | Jul 17, 2017 | Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry. |
| CVE-2017-11127 | Medium (5.4) | 0.55% | — | Jul 17, 2017 | Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header. |
| CVE-2015-7309 | Medium (6.5) | 39% | — | Sep 22, 2015 | The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it. |