CVE-2019-15485

Cross-site Scripting in Bolt

6.1 MediumFix available

CVE-2019-15485 is a medium vulnerability (CVSS 6.1) in Boltcms Bolt, published August 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in bolt/bolt 3.6.10.

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.86%Up 0.2 points since Apr 14, 2021

What each source reports

NVD Score used 6.1

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.

Record: CVE-2019-15485
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.

Record: CVE-2019-15485
Updated: 2026-11-02

EUVDEUVD-2019-0744 No score

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.

Record: EUVD-2019-0744
Updated: 2026-11-03

GitHub AdvisoriesGHSA-cj8p-53v9-2c26 6.1

Cross-site Scripting in Bolt

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.

Record: GHSA-cj8p-53v9-2c26
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.

Record: CVE-2019-15485
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-cj8p-53v9-2c26 6.1

Cross-site Scripting in Bolt

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.

Record: GHSA-cj8p-53v9-2c26
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

boltcms bolt

Affected packages

Affected packages
Package	Affected	Fixed
`bolt/bolt` Packagist	before 3.6.10	3.6.10
`bolt/bolt` Packagist	before 3.6.10, plus listed versions 3.5.7v0.8.4v0.8.5v0.9.10v0.9.5 Show 45 moreShow less v1.0.0v1.0.5v1.1.2v1.1.4v1.2.1v1.3.0v1.4.0v1.4.3v1.5.1v1.5.6v1.6.0v1.6.2v1.6.3v1.6.3.1v1.6.9v2.0.0v2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.1.0v2.1.1v2.1.1-pl1v2.1.2v2.1.3v2.1.3-pl1v2.1.4v2.1.4-pl1v2.1.5v2.1.6v2.1.7v2.1.8v2.1.8-pl1v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.13v2.2.14v2.2.15v2.2.16v2.2.17	3.6.10

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 101 versions. The JSON record has them.