[ SECURITY ADVISORY DOSSIER // CIAMISKAB-CSIRT ]

Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

CVE-2025-35939 Medium CVSS 5.3 In-The-Wild Exploited

Kembali ke Katalog Advisories

Ringkasan Kerentanan (Vulnerability Overview)

Rilis: 01 October 2026

Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.

Tindakan Mitigasi yang Wajib Diterapkan (Required Action)

Instruksi Keamanan untuk Pengelola TI / OPD

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Seluruh pengelola server dan aplikasi di lingkungan OPD Kabupaten Ciamis diimbau untuk segera mengaudit perangkat terdampak dan mengaplikasikan patch sebelum batas waktu mitigasi.

Produk & Versi Terdampak

Produk	Versi Basis	Batas Terdampak	Status Keamanan
CMS	0	5.7.5	AFFECTED
CMS	5.7.5	—	UNAFFECTED
CMS	0	4.15.3	AFFECTED
CMS	4.15.3	—	UNAFFECTED

[ BAGIKAN PERINGATAN KE TIM TEKNIS ]

WhatsApp Telegram

Threat Intelligence Matrix

CVE Identifier

CVE-2025-35939

Vendor / Project Craft CMS

Produk Terdampak Craft CMS

Skor CVSS

5.3 / 10.0

Status Eksploitasi AKTIF (In-The-Wild)

Kampanye Ransomware Tidak Diketahui

Automatable (Wormable) Unknown

Dampak Teknis Total

Sumber Intelijen CISA KEV

Butuh Pendampingan Mitigasi?

Tim Ciamiskab-CSIRT siap mendampingi verifikasi kerentanan dan langkah pengamanan aset digital OPD Anda.

Lapor ke CSIRT WhatsApp Hotline CSIRT

Peringatan Lainnya

CVE-2026-17544 High

Out-of-bounds write in bccomp() via crafted operand and scale

CVE-2026-17543 High

SQL injection in ext-pgsql via E'...' backslash breakout

CVE-2026-7260 Medium

Stack overflow in phar with circular symlinks

CVE-2026-109619 Critical

RCE via stale global state

CSIRT Assistant

Halo 👋 Ada yang bisa saya bantu? Jika perlu, chat ini bisa diteruskan ke admin.