CVE-2026-65693 Details
Description
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('system') into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.
A server-side template injection vulnerability has been identified in Microweber CMS versions through 2.0.20. This vulnerability allows authenticated administrators to execute arbitrary operating system commands by injecting Twig expressions into mail templates. The issue arises because the Twig environment used to render these templates is unsandboxed, lacking the necessary security extensions to prevent such injections. Malicious expressions can be executed automatically during application events that trigger mail dispatch, creating a persistent remote code execution risk.
It is recommended to add a SandboxExtension with a strict allowlist to the TwigView render method and to sanitize mail template content before saving it to the database.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 24, 2026CISA-ADP
Assessed Jul 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/W40X/584f4b088d310bc5280cc74bbf97831a | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/microweber-cms-server-side-template-injection-via-mail-templates | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Microweber | <= 2.0.20 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 25, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | New CVE Received | [email protected] |