Bolt CMS (<= 5.1.12) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/bolt-cms--5.1.12/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 01 Nov 2026 17:06:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBolt CMS: Authenticated Remote Code Execution via File Manager (CVE-2022-36532)https://feed.craftedsignal.io/briefs/2026-11-bolt-cms-rce/Sun, 01 Nov 2026 17:06:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-bolt-cms-rce/A public exploit PoC has been published for CVE-2022-36532, an authenticated remote code execution vulnerability in Bolt CMS versions 5.1.12 and earlier. The vulnerability involves improper file extension enforcement and parameter confusion during file rename operations.<p>A proof-of-concept exploit is available for CVE-2022-36532, which affects Bolt CMS versions 5.1.12 and earlier. The vulnerability allows an authenticated user with access to the file manager to achieve remote code execution. The attack involves uploading a malicious file through the asynchronous upload endpoint - where file extension restrictions are not properly enforced - and subsequently using parameter confusion during a rename operation to convert the file into an executable PHP script.</p> highadvisory