CVE-2020-4041
The filename of uploaded files vulnerable to stored XSS in Bolt CMS
In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
The filename of uploaded files vulnerable to stored XSS in Bolt CMS
In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.
- Record
CVE-2020-4041- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2020-0462
In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.
- Record
EUVD-2020-0462- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-68q3-7wjp-7q3j
The filename of uploaded files vulnerable to stored XSS
Impact
The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it.
Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented.
Patches
This is fixed in Bolt 3.7.1.
References
Related issue: https://github.com/bolt/bolt/pull/7853
- Record
GHSA-68q3-7wjp-7q3j- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.
- Record
CVE-2020-4041- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVAZL-110321
CVE-2020-4041 affecting package bolt 0.9.8-1
In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.
- Record
AZL-110321- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-05
OSV
In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.
- Record
CVE-2020-4041- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-68q3-7wjp-7q3j
The filename of uploaded files vulnerable to stored XSS
Impact
The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it.
Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented.
Patches
This is fixed in Bolt 3.7.1.
References
Related issue: https://github.com/bolt/bolt/pull/7853
- Record
GHSA-68q3-7wjp-7q3j- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bolt/boltPackagist |
before 3.7.1 | 3.7.1 |
boltAzure Linux:3 |
through 0.9.8-1 | None known |
bolt/boltPackagist |
before 3.7.1, plus listed versions 3.5.7v0.8.4v0.8.5v0.9.10v0.9.5 Show 45 moreShow lessv1.0.0v1.0.5v1.1.2v1.1.4v1.2.1v1.3.0v1.4.0v1.4.3v1.5.1v1.5.6v1.6.0v1.6.2v1.6.3v1.6.3.1v1.6.9v2.0.0v2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.1.0v2.1.1v2.1.1-pl1v2.1.2v2.1.3v2.1.3-pl1v2.1.4v2.1.4-pl1v2.1.5v2.1.6v2.1.7v2.1.8v2.1.8-pl1v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.13v2.2.14v2.2.15v2.2.16v2.2.17 |
3.7.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-4041 is a high vulnerability (CVSS 7.4) in Bolt, published June 8, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.08%, the 81st percentile. Fixed in bolt/bolt 3.7.1.
References
github.com/bolt/bolt/pull/7853
packetstormsecurity.com/files/158299/Bolt-CMS-3.7.0-XSS-CSRF-Shell-Upload.html
seclists.org/fulldisclosure/2020/Jul/4
nvd.nist.gov/vuln/detail/CVE-2020-4041
Left out here: 104 versions. The JSON record has them.