CVE-2022-36532

Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload and rename a malicious file to achieve remote code execution.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

23.36% chance of exploitation in the next 30 days, 98th percentile

Published

2022-09-16

Updated

2026-07-09

Proof-of-concept exploits (2)

• https://lutrasecurity.com/en/articles/cve-2022-36532/
• lutrasecurity/CVE-2022-365323★ · 2022-09-05

References

• CVE Record
• NVD entry

Related

• CVE-2025-1910
• CVE-2022-3653
• CVE-2022-36534
• CVE-2022-36522
• CVE-2022-36536
• CVE-2022-36520