CyberRota Analysis
AI-GeneratedBolt CMS is vulnerable due to its rendering of content field values through Twig without proper sandboxing, allowing any user with edit access to inject malicious Twig payloads. This flaw can lead to remote code execution, enabling attackers to execute arbitrary OS commands with the privileges of the web server user. Organizations using Bolt CMS should prioritize addressing this vulnerability, particularly those with standard editor roles that have access to content editing.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing.