Bolt vulnerabilities
We track 2 vulnerabilities in Bolt products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 5, 2026.
2vulnerabilities
0critical
2high
0exploited
8.8average CVSS score
Latest Bolt vulnerabilities
- 8.8 High severity
core: Improper Neutralization of Special Elements Used in a Template Engine
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field de
- 8.8 High severity
CMS: Improper Control of Generation of Code
Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which