Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Ent…

CVE-2026-71291 describes a critical Server-Side Template Injection (SSTI) vulnerability in Bolt CMS. The vulnerability exists in src/Entity/Field.php where the getTwigValue() method renders field content through Twig's full application-level Environment without any SandboxExtension. The default configuration in contenttypes.yaml enables allow_twig on the 'pages' content type out of the box, meaning any standard editor-role user (not just administrators) can exploit this. An attacker can inject Twig payloads such as {{ ['id']|map('passthru')|join }} into content fields to execute arbitrary OS commands. This results in remote code execution running as the web server user. The flaw is particularly severe because it requires no special privileges beyond basic content editing access and is enabled by default configuration.