Bolt CMS core renders content field values with Twig’s full environment without any sandboxing. The allow_twig flag enables rendering of raw field data, and the code compiles and executes the template when the content is rendered. A crafted Twig payload such as {{ ['id']|map('passthru')|join }} allows an attacker to run arbitrary OS commands, achieving remote code execution as the web server user.

This flaw affects Bolt CMS core where the default pages content type sets allow_twig: true in the bundled configuration. Any user with edit permissions for that content type—including standard editors—can introduce malicious Twig payloads. Specific version numbers are not listed in the advisory, so all releases that ship the default pages content type configuration are potentially vulnerable.

The CVSS score is 8.8, signifying a high‑severity vulnerability. The EPSS score indicates a 0.00473 exploitation probability, roughly 0.47%. It is not listed in CISA KEV, yet the flaw enables a direct code execution path through the web interface. Attackers only need web access and edit capability to inject malicious data, then trigger rendering, resulting in uncontrolled execution of commands. The combination of high impact and the likelihood that many installations retain the default allow_twig setting makes this a critical security risk.