CVE-2026-65693

What it is

Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('system') into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.

At a glance

Exploitability

Can be exploited over the network with an admin-level account. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.9% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-07-24 16:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-07-28 20:37 UTC Last updatedMost recent change to the record

Details

Published

2026-07-24 16:16 UTC

Last modified

2026-07-28 20:37 UTC

Exploit probability

0.9% · EPSS, next 30 days

Weakness

CWE-94 · Code injection

Record status

Deferred

Attack profile CVSS 4.0 · 8.6

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High