What is the CVSS score of CVE-2026-71291?

CVE-2026-71291 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Bolt CMS are affected by CVE-2026-71291?

Bolt CMS contains a critical template injection flaw in its default configuration that permits editor-level users to inject and execute system commands with web server privileges.

How to fix or mitigate CVE-2026-71291?

Within 24 hours: Identify all Bolt CMS installations, confirm whether Twig template rendering is enabled in the pages content type (default is enabled), audit editor-level user accounts for unauthorized access, and review recent content modifications for suspicious template syntax. Within 7 days: Disable Twig template rendering by setting `allow_twig: false` in the pages content type configuration, restrict editor role assignments to essential trusted staff, and implement server-side content validation to reject Twig filter directives. Within 30 days: Continue monitoring Bolt CMS security advisories for patch release, conduct staff security training on template injection risks, and schedule validation testing once patches become available.

Bolt CMS CVE-2026-71291

EUVD-2026-53376 HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-08-05 TuranSec

GHSA-m6xj-xx3f-5vv9

PHP RCE Ssti Bolt Core

8.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable CMS requiring only editor credentials (PR:L); default config enables the flaw; full RCE yields complete CIA loss on the server.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:48 vuln.today

CVE Published

Aug 05, 2026 - 12:38 cve.org

HIGH 8.8

DescriptionCVE.org

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue() calls shouldBeRenderedAsTwig(), which gates rendering only on the field definition's allow_twig flag and a regex checking for {{, {%, or {#; when true, the raw field value is compiled and rendered via self::getTwig()->createTemplate($value)->render(['record' => $this->getContent()]) with no sandboxing. Bolt's own bundled config/bolt/contenttypes.yaml sets allow_twig: true on the default "pages" contenttype's content field out of the box. Any user with edit access to that content type (a standard editor role, not just an administrator) can inject a Twig payload such as {{ ['id']|map('passthru')|join }} that executes arbitrary OS commands when the content is saved and rendered, achieving remote code execution as the web server user.

AnalysisAI

Unsandboxed Twig template rendering in Bolt CMS allows any user holding an editor-level CMS role to inject arbitrary OS commands via Server-Side Template Injection (SSTI), achieving remote code execution as the web server process. The root cause is that Bolt's Twig environment never registers a SandboxExtension, so the full Twig filter chain - including dangerous filters like passthru - is available to content authors. The default out-of-the-box configuration of the 'pages' content type ships with allow_twig: true, meaning this is exploitable in a standard Bolt installation without any additional misconfiguration. No public exploit has been independently confirmed, though the CVE description includes a working payload demonstrating command execution.

Technical ContextAI

Bolt CMS (PHP, CPE cpe:2.3:a:bolt:core:*:*:*:*:*:*:*:*) uses the Twig templating engine to render dynamic content stored in the database. The vulnerable code path is in src/Entity/Field.php, where getTwigValue() invokes shouldBeRenderedAsTwig() - a gate that checks only the allow_twig field-definition flag and the presence of Twig delimiters ({{, {%, {#) in the value. When both conditions are met, the raw field value is compiled and rendered via self::getTwig()->createTemplate($value)->render(...). Twig provides a SandboxExtension specifically designed to restrict what operations are permitted in untrusted template input, but Bolt's codebase registers no sandbox policy at any point in the application. CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) directly describes this root cause: user-controlled template fragments are compiled and evaluated in the same privileged environment as application templates, allowing filter chains such as {{ ['id']|map('passthru')|join }} to invoke PHP's passthru() and execute arbitrary shell commands.

RemediationAI

No vendor-released patch version has been identified at time of analysis. The primary remediation is to register Twig's SandboxExtension with a restrictive SecurityPolicy that whitelists only safe tags, filters, and functions - this would prevent untrusted content from calling PHP functions like passthru, shell_exec, or system. Until a patch is available from the Bolt maintainers (monitor https://github.com/bolt/core for releases), organizations should apply the following compensating controls: set allow_twig: false on all content type field definitions in config/bolt/contenttypes.yaml, including the default 'pages' content type - this directly disables the vulnerable rendering path, though it removes Twig functionality from content fields for all editors. Alternatively, restrict the editor role's access to content types with allow_twig: true so only trusted administrators can publish to those fields, reducing the privilege exposure from PR:L to PR:H in practice. Web Application Firewalls can be configured to detect Twig SSTI payloads (signatures on |map(, passthru, shell_exec in POST bodies), though this is bypassable and should not be the sole control. No vendor advisory URL was available in the provided references beyond the upstream repository.