Craft CMS External Control of Assumed‑Immutable Web Parameter (CVE‑2025‑35939) Allows Unauthenticated Code Injection
What It Is – Craft CMS (v 4.x and earlier) contains an external control of assumed‑immutable web parameter flaw. An unauthenticated client can supply arbitrary values that are written to a known file location on the server, potentially injecting PHP code.
Exploitability – The vulnerability is exploitable without authentication; a proof‑of‑concept exists. CVSS v3.1 is rated 8.8 (High).
Affected Products – Craft CMS (all supported versions prior to the vendor‑issued fix).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous input‑validation controls and evidence that they are enforced across releases.
- Highlights gaps in configuration‑management and change‑control processes that auditors will scrutinize.
- Provides a concrete case where defensible audit trails (e.g., patch‑management logs, WAF rule updates) become essential to prove due‑diligence to regulators and enterprise buyers.
Recommended Actions
- Apply the Craft CMS security patch released on 2025‑03‑15.
- Verify that all web‑parameter handling code enforces strict sanitisation and immutability checks.
- Update WAF/IPS signatures to block the specific payload patterns described in the advisory.
- Capture remediation evidence (patch logs, configuration snapshots) in a centralized Trust Center for audit readiness.
Source: CISA KEV – CVE‑2025‑35939