{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/bolt-cms--5.1.12/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:bolt:bolt_cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2022-36532"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Bolt CMS (\u003c= 5.1.12)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA proof-of-concept exploit is available for CVE-2022-36532, which affects Bolt CMS versions 5.1.12 and earlier. The vulnerability allows an authenticated user with access to the file manager to achieve remote code execution. The attack involves uploading a malicious file through the asynchronous upload endpoint - where file extension restrictions are not properly enforced - and subsequently using parameter confusion during a rename operation to convert the file into an executable PHP script.\u003c/p\u003e\n","date_modified":"2026-11-01T17:06:41Z","date_published":"2026-11-01T17:06:41Z","id":"https://feed.craftedsignal.io/briefs/2026-11-bolt-cms-rce/","summary":"A public exploit PoC has been published for CVE-2022-36532, an authenticated remote code execution vulnerability in Bolt CMS versions 5.1.12 and earlier. The vulnerability involves improper file extension enforcement and parameter confusion during file rename operations.","title":"Bolt CMS: Authenticated Remote Code Execution via File Manager (CVE-2022-36532)","url":"https://feed.craftedsignal.io/briefs/2026-11-bolt-cms-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Bolt CMS (\u003c= 5.1.12)","version":"https://jsonfeed.org/version/1.1"}