Loading vulnerability details…
CVSS v3.1
N/A
EPSS
38.61%
Published
Sep 22, 2015
Modified
May 6, 2026
Public PoC / Exploit (2)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
Weaknesses (CWE)
Affected Products (1)
References (12)