CVE-2026-71291
- Source
- https://cve.org/CVERecord?id=CVE-2026-71291
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71291.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-71291
- Published
- 2026-08-05T12:38:41.070Z
- Modified
- 2026-08-07T03:46:54.630337982Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering
- Details
-
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue() calls shouldBeRenderedAsTwig(), which gates rendering only on the field definition's allow_twig flag and a regex checking for
{{,{%, or{#; when true, the raw field value is compiled and rendered viaself::getTwig()->createTemplate($value)->render(['record' => $this->getContent()])with no sandboxing. Bolt's own bundled config/bolt/contenttypes.yaml setsallow_twig: trueon the default "pages" contenttype's content field out of the box. Any user with edit access to that content type (a standard editor role, not just an administrator) can inject a Twig payload such as{{ ['id']|map('passthru')|join }}that executes arbitrary OS commands when the content is saved and rendered, achieving remote code execution as the web server user. - Database specific
{ "cna_assigner": "TuranSec", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71291.json", "cwe_ids": [ "CWE-1336" ] }- References