CVE-2026-71291

8.8 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows untrusted content to be executed as Twig templates without sandboxing, enabling Remote Code Execution (RCE).
Exploitability: Exploitation requires access to field values and knowledge of the allow_twig flag configuration; moderate difficulty.
Blast radius: If exploited, it could lead to full server compromise affecting all users and data on the site.
Prioritized remediation: Disable or remove the allow_twig flag from fields that do not require Twig rendering or update Bolt CMS to a patched version.

rcewebcmssecurity

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-1336

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.