A user possessing valid credentials in Bolt CMS 3.7.0 and earlier can inject arbitrary PHP code into the profile displayname field. That code is rendered without sanitization when the user profile is displayed in backend templates. By exploiting the /async/browse/cache/.sessions endpoint to list session files and the /async/folder/rename endpoint to rename them, the attacker can move a session file to a path under the publicly accessible /files/ directory and give it a ".php" extension. The web server then treats the renamed file as executable PHP, turning the injected code into a web shell. A crafted HTTP GET request to that rogue file activates the payload, providing the attacker with unrestricted code execution on the affected host.

Bolt CMS versions 3.7.0 and earlier, provided by the Bolt:CMS vendor. The vendor has announced end-of-life for Bolt 3 as of 31 December 2021, meaning no further security support is offered for these releases.

The CVSS score of 7.5 indicates a high severity condition. An EPSS score of 64% suggests a significant likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. Attackers must first authenticate to the system; once authenticated, they can follow the described path to achieve arbitrary code execution. The combination of authentication, payload injection, file manipulation, and execution in a public directory results in a powerful attack vector that poses a severe risk to confidentiality, integrity, and availability of affected installations.