CVE-2026-65693 in Microweber
Summary
by MITRE • 07/24/2026
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('system') into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability exists within Microweber CMS version 2.0.20 and earlier, representing a critical server-side template injection flaw that can be exploited by authenticated administrators to achieve arbitrary operating system command execution. The core technical issue stems from the application's unsandboxed Twig environment implementation in the TwigView::render() method, which fails to implement proper security controls including the absence of SandboxExtension or SecurityPolicy mechanisms that would normally prevent malicious template code execution. The vulnerability specifically manifests when administrators interact with mail template functionality, as these templates are stored unsanitized within the database and subsequently rendered without proper input validation or sanitization processes.
The operational impact of this vulnerability is severe and far-reaching, as it enables attackers who have obtained administrative privileges to execute arbitrary system commands directly on the affected server. When malicious Twig expressions such as filter('system') are injected into mail template bodies, these payloads automatically execute whenever the application triggers any mail dispatch event, creating a persistent backdoor that can be leveraged for ongoing unauthorized access and system compromise. The unsanitized storage of user-supplied template content in the database means that even legitimate administrators may inadvertently trigger malicious code execution during routine operations, making this vulnerability particularly dangerous as it can be exploited during normal application usage patterns.
The exploitation pathway follows a predictable pattern where authenticated attackers leverage their administrative privileges to modify mail templates through the CMS interface, inserting malicious Twig syntax that bypasses normal security boundaries. This vulnerability directly maps to CWE-74 and CWE-94, which respectively address injection flaws and code injection vulnerabilities, while also aligning with ATT&CK technique T1059.007 for command and script injection. The lack of proper sandboxing in the Twig rendering environment removes critical security boundaries that would normally isolate potentially malicious template code execution from the underlying operating system. Organizations should immediately implement mitigations including thorough input validation, sanitization of all user-supplied template content, implementation of proper Twig security policies with SandboxExtension, and immediate patching to version 2.0.21 or later where these vulnerabilities have been addressed through enhanced template security controls and proper isolation mechanisms for template rendering processes.
The persistence of this vulnerability across application events makes it particularly dangerous as it operates silently in the background, executing payloads whenever mail dispatch functionality is triggered regardless of user awareness or intervention. This characteristic transforms what might initially appear to be a limited privilege escalation into a persistent system compromise that can be leveraged for data exfiltration, lateral movement, or further attack progression within compromised network environments. The vulnerability's impact extends beyond immediate command execution as it provides attackers with direct access to system resources, file operations, and potential privilege escalation opportunities that could lead to complete system takeover and broader organizational security breaches.