CVE-2026-65693
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('system') into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.
- Score
- CVSS 4.0 8.6 High
- Status
- Deferred - disclosure@vulncheck.com
- Published
- 2026-07-24
- Last modified
- 2026-07-28
- Weaknesses
- CWE-94
Affected products
References
- https://gist.github.com/W40X/584f4b088d310bc5280cc74bbf97831a
- https://www.vulncheck.com/advisories/microweber-cms-server-side-template-injection-via-mail-templates
