CVE-2026-65693
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Microweber CMS through version 2.0.20 contains a server-side template injection vulnerability. Authenticated administrators can achieve arbitrary OS command execution by injecting Twig expressions into mail templates.
Risk Assessment
Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions like filter('system') into mail template bodies. This causes automatic payload execution on each subsequent application event that triggers a mail dispatch.
Recommendation
Immediately upgrade Microweber CMS to a version later than 2.0.20 and apply appropriate security measures for the Twig environment.
Other vulnerabilities in Microweber CMS
See all- CVE-2014-9464High
In Microweber CMS version 0.95 before 20141209, there is an SQL injection vulnerability in Category.php that allows remote attackers to execute arbitrary SQL commands via the category parameter.
- CVE-2026-67617Medium
Microweber CMS up to version 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system. An authenticated attacker can inject arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing three independent sanitization controls. The injected script executes without user interaction for every visitor to the public blog page and within the admin post editor.
- CVE-2026-65694High
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller. Unauthenticated attackers can read arbitrary files by supplying directory traversal sequences in the path query parameter.
Original NVD description (English source)
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('system') into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.