Executive brief
Bolt CMS, a popular content management system, contains a vulnerability in how it handles certain text fields. An attacker could inject malicious HTML code into the website, potentially altering the site's appearance or misleading users. Because this version of the software is no longer supported by the developer, no official security patch is expected.
Technical details
A vulnerability classified as HTML injection (CWE-80/CWE-74) exists in Bolt CMS up to version 3.7.5 within the HTML Attribute Handler component. The flaw is located in the `src/Storage/Field/Type/TextType.php` file, where improper neutralization of the 'style' argument allows for the injection of arbitrary HTML. The attack can be initiated remotely but requires low-level privileges and user interaction (UI:R). As the repository has been archived and the product is end-of-life (EOL), no official fix is available. Public exploit code is reportedly available.
Affected products
- Bolt Bolt CMS up to 3.7.5
Timeline
- 2026-06-08: disclosed: Initial public disclosure via VulDB and NVD.