CVE-2015-7309 File upload in n/a
Authenticated attackers can execute arbitrary code by renaming files with malicious extensions in the Bolt CMS theme editor.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-7309?
CVE-2015-7309 is a medium-severity vulnerability in n/a, published on 22 Sep 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
Weakness: CWE-74
Which versions are affected by CVE-2015-7309?
It affects 1 product.
Products include Boltcms Bolt.
How do I fix CVE-2015-7309?
No fix has been published for CVE-2015-7309 yet. Limit exposure of the affected software until one is available.
Is CVE-2015-7309 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-7309 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in n/a
- CVE-2022-31321 Path traversal in n/a
- CVE-2019-10874 Bolt Cross Site Request Forgery (CSRF)
- CVE-2019-9185 Bolt Unrestricted Upload of File with Dangerous Type
- CVE-2020-4040 CSRF issue on preview pages in Bolt CMS
- CVE-2025-34086 Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename
Sources
Also known as GHSA-gfg2-33mf-746p.