CVE-2026-71291 Details
Description
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing.
A remote code execution vulnerability exists in Bolt CMS versions 6.1.6 and prior. The issue arises because the application allows content field values to be rendered through Twig's full environment without any sandboxing. This vulnerability is located in the 'src/Entity/Field.php' file, where the 'getTwigValue()' function renders raw field values as Twig templates. The default 'pages' content type configuration permits Twig usage, enabling users with edit access to inject and execute arbitrary operating system commands via crafted Twig payloads when the content is saved and rendered.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bolt/core | TuranSec | Vendor |
| https://github.com/bolt/core/blob/6.1/src/Entity/Field.php | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Bolt CMS | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |