CVE-2026-65693 microweber CVE debrief

Who should care

System administrators and security teams responsible for Microweber CMS installations, especially those with version 2.0.20 or earlier, should urgently review and secure their environments. Authenticated administrators with access to mail template editing are at risk of exploitation.

Technical summary

CVE-2026-65693 is a server-side template injection vulnerability in Microweber CMS through 2.0.20. Authenticated administrators can exploit this vulnerability to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. The vulnerability exists due to an unsandboxed Twig environment in TwigView::render(), lacking SandboxExtension or a SecurityPolicy. Malicious expressions, such as filter('system'), can be injected into mail template bodies stored unsanitized in the database, leading to automatic payload execution on subsequent mail dispatch events.

Defensive priority

Authenticated administrators should urgently review and secure mail template usage, focusing on unsandboxed Twig environments.

Recommended defensive actions

• Review and secure mail template usage in Microweber CMS, focusing on unsandboxed Twig environments.
• Restrict access to mail template editing for non-administrative users.
• Implement sandboxing for Twig environments used in mail templates.
• Monitor for suspicious mail dispatch events that could indicate exploitation attempts.
• Apply vendor patches or updates as soon as available.

Evidence notes

The CVE-2026-65693 record indicates a server-side template injection vulnerability in Microweber CMS through 2.0.20, allowing authenticated administrators to achieve arbitrary OS command execution. The vulnerability is due to an unsandboxed Twig environment in TwigView::render(). Evidence is based on official CVE and NVD records, as well as references from Vulncheck.

Official resources