What’s Vulnerable › Vulnerabilities

CVE-2026-65693: Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-24 · updated 2026-07-28
• Weakness: CWE-94

Description

Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('system') into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.

Affected products

• microweber/microweber: through 2.0.20

References

• https://gist.github.com/W40X/584f4b088d310bc5280cc74bbf97831a
• https://www.vulncheck.com/advisories/microweber-cms-server-side-template-injection-via-mail-templates

Get alerted when CVE-2026-65693 or the next vulnerability affects your stack