bolt/core vulnerabilities

Latest bolt/core CVEs

Newest publication first

1. CVE-2026-71291 Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering

   Published 2026-08-05

   High·CVSS 8.8 EPSS 0.55%

   Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twi...

2. CVE-2021-40219 Code Injection in Bolt CMS

   Published 2022-04-11

   High·CVSS 8.8 EPSS 3.4% PoC

   Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution.

3. CVE-2021-27367 Path traversal in bolt/core

   Published 2021-02-17

   High·CVSS 7.5 EPSS 1.8%

   Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.