CVE-2026-65693 Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
Authenticated administrators can execute arbitrary OS commands by injecting Twig expressions into mail templates due to an unsandboxed rendering environment.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-65693?
CVE-2026-65693 is a high-severity code injection vulnerability in microweber, published on 24 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('system') into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.
Weakness: CWE-94
Which versions are affected by CVE-2026-65693?
How do I fix CVE-2026-65693?
No fix has been published for CVE-2026-65693 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-65693 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65693 exists.
Sources
Also known as GHSA-5hv4-9f73-fvrj.