CVE-2026-71291: Bolt CMS RCE Vulnerability

CVE-2026-71291 Overview

CVE-2026-71291 is a server-side template injection (SSTI) vulnerability in Bolt CMS that allows authenticated editors to achieve remote code execution. Bolt CMS renders content field values through Twig's full application-level Environment without registering a SandboxExtension anywhere in the codebase. The default bundled config/bolt/contenttypes.yaml enables allow_twig: true on the pages content type's content field. Any user with edit access to that content type can inject Twig payloads that execute arbitrary operating system commands as the web server user. The weakness is classified under [CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine].

Critical Impact
An authenticated editor, not just an administrator, can achieve remote code execution on the underlying web server through Twig payloads in content fields.

Affected Products

Bolt CMS Core (repository bolt/core)
Bolt CMS branch 6.1 referenced in the vulnerable src/Entity/Field.php
Deployments using the default bundled contenttypes.yaml configuration

Discovery Timeline

2026-08-05 - CVE-2026-71291 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71291

Vulnerability Analysis

The vulnerability resides in src/Entity/Field.php, where getTwigValue() calls shouldBeRenderedAsTwig(). This gate checks only the field definition's allow_twig flag and a regex looking for {{, {%, or {#. When both conditions are true, the raw field value is compiled and rendered through self::getTwig()->createTemplate($value)->render(['record' => $this->getContent()]).

Because Bolt uses the full application Twig Environment with no SandboxExtension registered, all Twig functions, filters, and PHP callables reachable through Twig become available to attacker-controlled input. This transforms every editable content field on the default pages content type into an SSTI sink.

Root Cause

The root cause is a missing sandbox on a template engine that evaluates untrusted input. Twig ships a SandboxExtension designed precisely to constrain user-supplied templates to a whitelist of safe tags, filters, and methods. Bolt does not register this extension, so createTemplate($value) inherits the unrestricted environment used for trusted application templates.

Compounding the issue, the default configuration ships with allow_twig: true on the content field of the pages content type. Standard editor roles inherit this capability out of the box without any administrative action.

Attack Vector

An authenticated user with edit access to the pages content type submits a content field containing a Twig expression. On save and subsequent render, the payload is compiled and executed. A payload such as {{ ['id']|map('passthru')|join }} invokes the PHP passthru function via Twig's map filter, executing the id command and returning output as the rendered page.

Successful exploitation yields arbitrary OS command execution as the web server user, enabling filesystem access, credential theft from configuration files, lateral movement, and persistence.

Detection Methods for CVE-2026-71291

Indicators of Compromise

Content field values in the database or version history containing Twig delimiters {{, {%, or {# combined with sensitive filters or functions such as map, filter, reduce, passthru, system, exec, or shell_exec
Web server processes spawning unexpected child processes such as sh, bash, id, curl, or wget under the PHP-FPM or Apache user context
Unexpected outbound connections initiated from the Bolt web server host shortly after content edits

Detection Strategies

Audit stored records in the Bolt database for Twig control sequences inside fields on content types where allow_twig is enabled
Enable PHP disable_functions monitoring or auditd rules on execve to identify command execution originating from the web server process
Correlate Bolt editor session activity with process execution events on the host to identify editors triggering shell commands

Monitoring Recommendations

Log and review all content edits performed by non-administrator editor roles against content types that permit Twig
Monitor file integrity on the Bolt public/ and config/ directories for unauthorized additions such as web shells
Alert on new outbound network connections from the web server user that do not match established application baselines

How to Mitigate CVE-2026-71291

Immediate Actions Required

Set allow_twig: false on every field in config/bolt/contenttypes.yaml, including the default pages content type's content field
Restrict edit access to content types until the configuration change is deployed and verified
Review existing content records for stored Twig payloads and purge any that were not authored by trusted administrators

Patch Information

No vendor patch identifier is listed in the NVD entry at the time of publication. Track the Bolt Core Repository and the vulnerable Field.php source for upstream fixes that introduce a Twig SandboxExtension or remove unrestricted rendering of user-supplied field values.

Workarounds

Disable the allow_twig flag on all content type fields to prevent shouldBeRenderedAsTwig() from ever returning true for user-supplied content
Limit editor role assignments to a minimal set of trusted users until a sandboxed rendering path is available
Deploy a web application firewall rule that blocks form submissions containing Twig control tokens on the Bolt editor endpoints

bash

# Configuration example: disable Twig rendering on content fields
# File: config/bolt/contenttypes.yaml
pages:
    fields:
        content:
            type: redactor
            allow_twig: false