Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-1w3g-1bcg-9fb7
Vulnerability ID VCID-1w3g-1bcg-9fb7
Aliases CVE-2019-10874
GHSA-3g6c-88pf-m46f
Summary Cross-Site Request Forgery (CSRF) Cross Site Request Forgery (CSRF) in the `bolt/upload` File Upload feature in Bolt CMS allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the `file/edit/config/config.yml` configuration file.
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-352 Cross-Site Request Forgery (CSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 8.8 http://packetstormsecurity.com/files/152429/Bolt-CMS-3.6.6-Cross-Site-Request-Forgery-Code-Execution.html
generic_textual HIGH http://packetstormsecurity.com/files/152429/Bolt-CMS-3.6.6-Cross-Site-Request-Forgery-Code-Execution.html
epss 0.00389 https://api.first.org/data/v1/epss?cve=CVE-2019-10874
epss 0.00389 https://api.first.org/data/v1/epss?cve=CVE-2019-10874
epss 0.00389 https://api.first.org/data/v1/epss?cve=CVE-2019-10874
cvssv3.1 8.8 https://fgsec.net/from-csrf-to-rce-bolt-cms
generic_textual HIGH https://fgsec.net/from-csrf-to-rce-bolt-cms
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-3g6c-88pf-m46f
cvssv3.1 8.8 https://github.com/bolt/bolt
generic_textual HIGH https://github.com/bolt/bolt
cvssv3.1 8.8 https://github.com/bolt/bolt/pull/7768/commits/91187aef36363a870d60b0a3c1bf8507af34c9e4
generic_textual HIGH https://github.com/bolt/bolt/pull/7768/commits/91187aef36363a870d60b0a3c1bf8507af34c9e4
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2019-10874
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2019-10874
cvssv3.1 8.8 https://www.exploit-db.com/exploits/46664
generic_textual HIGH https://www.exploit-db.com/exploits/46664
Reference id Reference type URL
http://packetstormsecurity.com/files/152429/Bolt-CMS-3.6.6-Cross-Site-Request-Forgery-Code-Execution.html
https://api.first.org/data/v1/epss?cve=CVE-2019-10874
https://fgsec.net/from-csrf-to-rce-bolt-cms
https://github.com/bolt/bolt
https://github.com/bolt/bolt/pull/7768/commits/91187aef36363a870d60b0a3c1bf8507af34c9e4
https://www.exploit-db.com/exploits/46664
https://www.exploit-db.com/exploits/46664/
CVE-2019-10874 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/46664.html
CVE-2019-10874 https://nvd.nist.gov/vuln/detail/CVE-2019-10874
GHSA-3g6c-88pf-m46f https://github.com/advisories/GHSA-3g6c-88pf-m46f
Data source Exploit-DB
Date added April 8, 2019
Description Bolt CMS 3.6.6 - Cross-Site Request Forgery / Remote Code Execution
Ransomware campaign use Unknown
Source publication date April 8, 2019
Exploit type webapps
Platform php
Source update date April 8, 2019
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at http://packetstormsecurity.com/files/152429/Bolt-CMS-3.6.6-Cross-Site-Request-Forgery-Code-Execution.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://fgsec.net/from-csrf-to-rce-bolt-cms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/bolt/bolt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/bolt/bolt/pull/7768/commits/91187aef36363a870d60b0a3c1bf8507af34c9e4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-10874
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.exploit-db.com/exploits/46664
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.60312
EPSS Score 0.00389
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:39:04.338038+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/bolt/bolt/CVE-2019-10874.yml 38.6.0