Microweber CMS versions up to 2.0.20 allow an authenticated administrator to inject arbitrary Twig expressions into mail template bodies stored unsanitized in the database. When a mail event is triggered, the unsandboxed Twig environment rendered by TwigView::render() executes the malicious expression, enabling the attacker to run system commands with the web server’s privileges. This is a classic code‑execution flaw categorized as CWE‑94 and can compromise confidentiality, integrity, and availability of the host system.

The affected product is Microweber CMS, offered by the microweber vendor. All releases up to and including 2.0.20 are vulnerable. The issue impacts the default mail template functionality and persists across administrative sessions until the product is updated.

The CVSS score of 8.6 indicates high severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authentication as an administrator and relies on the ability to edit mail templates. Because the flaw is in template rendering rather than network‑level exposure, the attacker must first achieve administrative access, possibly through credential compromise or other weaknesses. Once a trusted user creates or edits a mail template containing a malicious Twig expression, it will be executed automatically each time a mail dispatch occurs, providing a persistent foothold.