{"action":"Upgrade craftcms/cms to 4.15.3 or later.","affected":[{"fixed":"5.7.5","introduced":"5.0.0-alpha.1"},{"fixed":"4.15.3","introduced":"0"}],"component":"craftcms/cms","cve_ids":["CVE-2025-35939"],"ecosystem":"Packagist","epss":0.01349,"exploited":true,"fixed_versions":["5.7.5","4.15.3"],"ghsa_id":"GHSA-7vrx-9684-xrf2","id":"tcs_01M5KEYE8QDG4V4TFZFV1MSTWY","modified_at":"2025-10-22T19:55:21.907700Z","published_at":"2025-05-08T00:31:12Z","references":["https://osv.dev/vulnerability/GHSA-7vrx-9684-xrf2","https://nvd.nist.gov/vuln/detail/CVE-2025-35939","https://github.com/craftcms/cms/pull/17220","https://github.com/craftcms/cms/commit/e4c7bac8f31010aee048409f9ef6f744a83146b2","https://github.com/craftcms/cms","https://github.com/craftcms/cms/releases/tag/4.15.3","https://github.com/craftcms/cms/releases/tag/5.7.5","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939","https://www.cve.org/CVERecord?id=CVE-2025-35939"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-7vrx-9684-xrf2","url":"https://osv.dev/vulnerability/GHSA-7vrx-9684-xrf2"},{"source":"kev","source_id":"CVE-2025-35939","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Craft CMS stores arbitrary content provided by unauthenticated users in session files"}