CVE-2026-71291 Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering
Attackers can execute arbitrary code by injecting Twig templates into fields with allow_twig enabled, as Bolt CMS lacks sandboxing.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71291?
CVE-2026-71291 is a high-severity code injection vulnerability in bolt core, published on 5 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing.
Weakness: CWE-1336
Which versions are affected by CVE-2026-71291?
How do I fix CVE-2026-71291?
No fix has been published for CVE-2026-71291 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-71291 being exploited?
There is no known exploitation of CVE-2026-71291 in the wild and no public exploit code.
Sources
Also known as GHSA-m6xj-xx3f-5vv9.