CVE-2015-7309: Boltcms Bolt

Medium severity, CVSS 6.5. EPSS: 38.6% chance of exploitation in the next 30 days.

The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.

Affected products

• Boltcms Bolt: up to and including 2.2.0

Published 2015-09-22. Last modified 2026-06-17.