CVE-2026-65693 — Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injec…
Published: 2026-07-24 · CVSS: 8.6 · CVSS 4.0
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('system') into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7