CVE-2026-65693: Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('system') into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65693?
The severity of CVE-2026-65693 is high, with a CVSS score of 7.2.
How do I fix CVE-2026-65693?
To fix CVE-2026-65693, upgrade Microweber CMS to version 2.0.21 or later where the vulnerability is patched.
What type of vulnerability is CVE-2026-65693?
CVE-2026-65693 is identified as a server-side template injection vulnerability.
Who is affected by CVE-2026-65693?
Authenticated administrators using Microweber CMS versions up to 2.0.20 are affected by CVE-2026-65693.
What can attackers achieve with CVE-2026-65693?
Attackers can achieve arbitrary OS command execution by injecting Twig expressions into mail templates.