Skip to content
OpenAdvisories

Product · bolt

core

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-71291

    Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering

    Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field d…

    bolt core