Bolt CMS: Authenticated Remote Code Execution via File Manager (CVE-2022-36532)
A public exploit PoC has been published for CVE-2022-36532, an authenticated remote code execution vulnerability in Bolt CMS versions 5.1.12 and earlier. The vulnerability involves improper file extension enforcement and parameter confusion during file rename operations.
CVE search metadata
CVE search record: CVE-2022-36532. Severity: high. CVSS: 8.8. EPSS: 24.31%. KEV: no. Product: Bolt CMS (<= 5.1.12). Brief: Bolt CMS: Authenticated Remote Code Execution via File Manager (CVE-2022-36532). Brief link: https://feed.craftedsignal.io/briefs/2026-11-bolt-cms-rce/
Triage facts
Revision 1- Applicability
- Bolt CMS (<= 5.1.12)
- Evidence
- Not observed
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 1, 17:06 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
A proof-of-concept exploit is available for CVE-2022-36532, which affects Bolt CMS versions 5.1.12 and earlier. The vulnerability allows an authenticated user with access to the file manager to achieve remote code execution. The attack involves uploading a malicious file through the asynchronous upload endpoint - where file extension restrictions are not properly enforced - and subsequently using parameter confusion during a rename operation to convert the file into an executable PHP script.