Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine in the getTwigValue process. An attacker can execute arbitrary code by injecting malicious Twig templates into content fields that are rendered without sandboxing. Th...

PT-2026-68163

Name of the Vulnerable Software and Affected Versions Bolt CMS affected versions not specified Description Bolt CMS renders content field values using the full Twig application-level Environment without a SandboxExtension. In the src/Entity/Field.php file, the getTwigValue function calls...