CVE-2026-39229
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Bolt CMS up to version 3.7.0 contains an SQL injection vulnerability in the 'order' parameter of content listing pages. An authenticated attacker with low privileges can exploit this via the OrderDirective component, allowing extraction of sensitive information.
Risk Assessment
Exposure of sensitive database data such as user data, content, or configuration by a low-privilege attacker – may lead to privilege escalation or data theft.
Recommendation
Immediately upgrade Bolt CMS to a version newer than 3.7.0 that includes a fix preventing SQL injection in the 'order' parameter.
Other vulnerabilities in Bolt CMS
See all- CVE-2022-36532High
Bolt CMS version 5.1.12 and below contains a vulnerability that allows an authenticated user with ROLE_EDITOR privileges to upload and rename a malicious file, leading to remote code execution.
- CVE-2026-71291High
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twig flag and a regex, then compiles and renders the raw value without sandboxing.
- CVE-2026-11511Low
In Bolt CMS up to version 3.7.5, in the TextType.php file of the HTML Attribute Handler component, manipulation of the style argument leads to HTML injection. The attack is remote, exploit is public. The GitHub repository is archived and read-only, and the product is no longer supported.
- CVE-2021-40219High
Bolt CMS version 4.2 and earlier is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit the theme and inject server-side template injection, leading to remote code execution.
Original NVD description (English source)
Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated attacker with low-level privileges can exploit this through the OrderDirective component. This allows for the extraction of sensitive information