Executive brief
Bolt CMS, a content management system used for building and managing websites, is vulnerable to a security flaw in its content listing pages. An attacker with low-level access (such as an Editor) can execute malicious database commands to steal sensitive information, including administrative passwords. This could lead to a full takeover of the website and its underlying database.
Technical details
A time-based blind SQL injection vulnerability exists in Bolt CMS versions up to and including 3.7.0. The flaw is located in the OrderDirective.php component within the __invoke() method, which handles content overview pages (e.g., /bolt/overview/pages). The 'order' parameter fails to properly sanitize or validate user-supplied input before appending it to the QueryBuilder's orderBy() clause. An authenticated attacker with low-level privileges can provide a malicious SQL payload to trigger time delays or extract sensitive data, such as administrative password hashes from the bolt_users table. The vulnerability is confirmed in version 3.7.0, and the repository has been archived as of January 2026, suggesting users should migrate to newer major versions like Bolt 5.
Affected products
- Bolt Bolt CMS through 3.7.0
Timeline
- 2026-01-14: other: GitHub repository archived by owner
- 2026-05-29: disclosed: CVE published