CVE-2026-65693

Name of the Vulnerable Software and Affected Versions Microweber CMS versions prior to 2.0.21

Description Authenticated administrators can achieve arbitrary OS command execution by injecting Twig expressions into mail templates. This occurs because the Twig environment in the TwigView::render() function is unsandboxed and lacks a SandboxExtension or SecurityPolicy. Malicious expressions, such as filter('system'), can be stored unsanitized in the database within mail template bodies, leading to automatic payload execution whenever an application event triggers a mail dispatch.

Recommendations Update Microweber CMS to version 2.0.21 or later.