https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 03:32:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349681 EUVD-2026-349681 https://cve.radiocsirt.org/vuln/euvd-2026-349681 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71291 <p>Bolt CMS renders content field values through Twig&#39;s full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition&#39;s allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing.</p> <p>Bolt CMS renders content field values through Twig&#39;s full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition&#39;s allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71291 https://cve.radiocsirt.org/vuln/ghsa-m6xj-xx3f-5vv9 <p>Bolt CMS renders content field values through Twig&#39;s full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue() calls shouldBeRenderedAsTwig(), which gates rendering only on the field definition&#39;s allow_twig flag and a regex checking for `{{`, `{%`, or `{#`; when true, the raw field value is compiled and rendered via `self::getTwig()-&gt;createTemplate($value)-&gt;render([&#39;record&#39; =&gt; $this-&gt;getContent()])` with no sandboxing. Bolt&#39;s own bundled config/bolt/contenttypes.yaml sets `allow_twig: true` on the default &#34;pages&#34; contenttype&#39;s content field out of the box. Any user with edit access to that content type (a standard editor role, not just an administrator) can inject a Twig payload such as `{{ [&#39;id&#39;]|map(&#39;passthru&#39;)|join }}` that executes arbitrary OS commands when the content is saved and rendered, achieving remote code execution as the web server user.</p> <p>Bolt CMS renders content field values through Twig&#39;s full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue() calls shouldBeRenderedAsTwig(), which gates rendering only on the field definition&#39;s allow_twig flag and a regex checking for `{{`, `{%`, or `{#`; when true, the raw field value is compiled and rendered via `self::getTwig()-&gt;createTemplate($value)-&gt;render([&#39;record&#39; =&gt; $this-&gt;getContent()])` with no sandboxing. Bolt&#39;s own bundled config/bolt/contenttypes.yaml sets `allow_twig: true` on the default &#34;pages&#34; contenttype&#39;s content field out of the box. Any user with edit access to that content type (a standard editor role, not just an administrator) can inject a Twig payload such as `{{ [&#39;id&#39;]|map(&#39;passthru&#39;)|join }}` that executes arbitrary OS commands when the content is saved and rendered, achieving remote code execution as the web server user.</p> https://cve.radiocsirt.org/vuln/ghsa-m6xj-xx3f-5vv9