CVE-2026-71291

Name of the Vulnerable Software and Affected Versions Bolt CMS (affected versions not specified)

Description Bolt CMS renders content field values using the full Twig application-level Environment without a SandboxExtension. In the src/Entity/Field.php file, the getTwigValue() function calls shouldBeRenderedAsTwig(), which only checks the allow twig flag and a regex for {{, {%, or {#. When these conditions are met, the raw field value is compiled and rendered via self::getTwig()->createTemplate($value)->render(['record' => $this->getContent()]) without sandboxing. Since the default content field for pages in config/bolt/contenttypes.yaml has allow twig set to true by default, users with edit access to that content type can inject Twig payloads to execute arbitrary OS commands as the web server user, leading to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.