Packagist/bolt/bolt CVE-2025-34086: high 8.8, EPSS 4.32%
Bolt CMS vulnerable to authenticated remote code execution
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.7.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-p9qc-8jjx-g8cg
- nvd: CVE-2025-34086
- https://boltcms.io/newsitem/major-announcements-bolt-3-eol-bolt-4-2-5-0-releases
- https://github.com/bolt/bolt
- https://github.com/bolt/bolt/blob/3.7/src/Controller/Backend/Users.php#L279-L311
- https://github.com/bolt/bolt/releases/tag/3.7.1
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/bolt_authenticated_rce.rb
- https://www.exploit-db.com/exploits/48296
- https://www.rapid7.com/db/modules/exploit/unix/webapp/bolt_authenticated_rce
CVE-2025-34086 · published · modified · JSON