CVE-2015-7309

The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files,...

6.5 MediumPublic exploit

The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.

Exploit likelihood

38.6%Down 27.9 points since Feb 4, 2022

What each source reports

NVD Score used6.5

Record: CVE-2015-7309
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-74
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2015-7309
Updated: 2026-11-02

EUVDEUVD-2015-7238No score

Record: EUVD-2015-7238
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gfg2-33mf-746pNo score

The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files,...

Record: GHSA-gfg2-33mf-746p
Weakness: CWE-74
Updated: 2026-11-02

OSVAZL-112877No score

CVE-2015-7309 affecting package bolt 0.9.8-1

Record: AZL-112877
Updated: 2026-11-10

Affected products

boltcms bolt

Affected packages

Affected packages
Package	Affected	Fixed
`bolt` Azure Linux:3	through 0.9.8-1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	CMS Bolt File Upload Vulnerability	2015-08-17
Exploit-DB	CMS Bolt - Arbitrary File Upload (Metasploit)	2015-09-15

History

History
Recorded	Changed	Sources
Nov 10, 2026	affected, aliases, exploits, facts, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-7309 is a medium vulnerability (CVSS 6.5) in Boltcms Bolt, published September 22, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 38.6%, the 98th percentile. No source names a fixed version.