CVE-2026-71291

Received Received - Intake

Remote Code Execution in Bolt CMS via Twig Sandbox Bypass

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-25

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-24

NVD

CVE-2026-71291

EUVD

EUVD-2026-53376

Affected Vendors & Products

Vendor	Product	Version / Range
bolt	cms	*
bolt	cms	to 3.7.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

This vulnerability in Bolt CMS allows authenticated users with edit access to execute arbitrary OS commands via Twig template injection. The issue occurs because Bolt CMS renders content fields through Twig without sandboxing, and the default content type has Twig rendering enabled. Attackers can inject malicious Twig code to achieve remote code execution as the web server user.

Detection Guidance

Check Bolt CMS versions prior to 3.7.1 for improper input validation. Inspect src/Entity/Field.php for getTwigValue() method usage without sandboxing. Look for allow_twig: true in contenttypes.yaml. Monitor for unexpected OS command execution traces in web server logs.

Impact Analysis

An attacker with edit access could execute arbitrary commands on the server, leading to full system compromise. This includes stealing sensitive data, installing malware, or using the server as a pivot point for further attacks. The impact is severe due to the high CVSS score (8.8) and the ease of exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Update Bolt CMS to the latest version. Disable allow_twig in contenttypes.yaml. Restrict edit access to content types. Implement input validation for Twig templates. Monitor for suspicious activity in logs.

Hi! I’m here to help you understand CVE-2026-71291. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70