PatchSiren cyber security CVE debrief
CVE-2026-39229 Bolt CVE debrief
CVE-2026-39229 documents a SQL injection vulnerability in Bolt CMS through version 3.7.0, specifically within the 'order' parameter of content listing pages. The vulnerability resides in the OrderDirective component and can be exploited by an authenticated attacker with low-level privileges to extract sensitive information. The CVSS v3.1 score of 6.5 (MEDIUM severity) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact. The weakness is classified as CWE-89 (SQL Injection). The CVE was published on 2026-05-29 and last modified the same day. The vulnerability status in NVD is currently 'Deferred'. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA KEV.
- Vendor
- Bolt
- Product
- Bolt CMS
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-29
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-29
- Advisory updated
- 2026-05-29
Who should care
Organizations running Bolt CMS versions 3.7.0 or earlier should prioritize assessment and remediation. Security teams managing PHP-based content management systems, particularly those with multi-user environments where low-privilege accounts exist, should evaluate exposure. Database administrators supporting Bolt CMS deployments should review access controls and query logging capabilities.
Technical summary
The vulnerability exists in Bolt CMS's OrderDirective component, which processes the 'order' parameter on content listing pages without adequate sanitization. An authenticated user with low privileges can manipulate this parameter to inject arbitrary SQL, enabling unauthorized data extraction from the underlying database. The attack requires no user interaction and can be conducted remotely. The confidentiality impact is rated HIGH due to potential exposure of sensitive database contents, while integrity and availability impacts are not applicable in this attack vector.
Defensive priority
medium
Recommended defensive actions
- Apply vendor-provided patches for Bolt CMS when available, prioritizing versions beyond 3.7.0
- Implement input validation and parameterized queries for all 'order' parameter handling in content listing functionality
- Review and restrict database permissions to limit impact of potential SQL injection exploitation
- Monitor application logs for anomalous query patterns in OrderDirective component usage
- Conduct code review of custom Bolt CMS extensions that may implement similar ordering functionality
Evidence notes
Vulnerability confirmed through official CVE record and NVD entry. Vendor identification derived from reference domain candidate 'Boltcms' with low confidence; vendor marked for review. Affected product explicitly identified as Bolt CMS through 3.7.0. Third-party reference to GitHub repository (Tonoss-412/My-CVE) provides additional technical context.
Official resources
2026-05-29