CVE-2026-11511: Bolt CMS HTML Injection Vulnerability – Unsupported Software Risk

Technical summary

The vulnerability exists in the TextType.php component's HTML Attribute Handler, which fails to properly sanitize user-supplied style arguments before rendering them in HTML output. This is classified as CWE-74 (Improper Neutralization of Special Elements) and CWE-80 (Improper Neutralization of Script-Related HTML Tags), allowing stored or reflected HTML injection. The CVSS 3.1 score of 3.5 reflects the requirement for authenticated access and user interaction, despite the network-accessible attack vector. The vulnerability does not directly enable code execution or confidentiality breaches on the server side.

Business impact

Organizations running unsupported Bolt CMS instances face increased operational risk. While the vulnerability's severity is low and requires authentication, it can be exploited to deface content, inject malicious scripts that target end users, or spread misinformation. The critical business issue is that the project is archived and no longer receives security updates, meaning future vulnerabilities will remain unpatched. This creates a long-term liability for compliance audits and customer trust, particularly for public-facing content management systems.

Affected systems

Bolt CMS versions up to and including 3.7.5 are affected. The vendor has archived the GitHub repository, indicating end-of-life status. No newer versions are available from the original maintainer. Organizations should identify all instances of Bolt CMS in their environment and assess whether any remain in production or development.

Exploitability

Public exploit code is available, lowering the barrier to proof-of-concept development. However, practical exploitation requires three conditions: (1) network access to a Bolt CMS instance, (2) valid authentication credentials, and (3) a user must view the injected content for the attack to manifest. The low CVSS score reflects these constraints. Attackers cannot directly achieve code execution or data exfiltration through this vector alone, but it is a stepping stone to more complex attack chains involving client-side exploitation.

Remediation

The fundamental remedy is migration away from Bolt CMS to an actively maintained content management system (such as WordPress with hardened plugins, Statamic, or a custom headless solution). If immediate replacement is impossible, implement network segmentation to restrict access to Bolt CMS administrators only, enforce strong password policies, and deploy a Web Application Firewall (WAF) with rules to detect and block HTML/script injection patterns in request parameters. Input validation and output encoding at the application layer would also reduce attack surface, but these cannot be implemented without patching the unmaintained codebase.

Patch guidance

No security patches are available from the original maintainers, as the project is archived and no longer supported. Verify this status with any community forks or third-party vendors who may have branched the codebase. Do not expect updates. Organizations must treat this as a sunset scenario and prioritize decommissioning or replacing affected instances within a documented timeline (recommend 6–12 months based on business criticality).

Detection guidance

Monitor access logs for authentication attempts to Bolt CMS administrators and audit successful logins for unusual patterns. Search request logs for suspicious 'style' attribute values containing script tags, event handlers (onclick, onload, etc.), or encoded payloads in URL or POST parameters targeting the TextType.php component or field input handlers. Implement file integrity monitoring on the src/Storage/Field/Type/ directory to detect unauthorized modifications. Security Information and Event Management (SIEM) queries can flag repeated HTML/script injection attempts in a short timeframe, suggesting active exploitation attempts.

Why prioritize this

Although the CVSS score is low, organizations should prioritize this issue based on maintenance status rather than raw severity. A vulnerability in unmaintained software with public exploits represents a permanent risk vector that cannot be patched. Prioritization should focus on identifying all affected instances and scheduling migrations, not on tactical patching. This is a strategic remediation decision, not an emergency.

Risk score, explained

The CVSS 3.1 score of 3.5 (LOW) reflects the authentication requirement (PR:L), user interaction requirement (UI:R), and lack of impact on confidentiality or system availability (C:N, A:N). The integrity impact is limited (I:L) because the attack affects the appearance of content rather than critical data or system control. The network-accessible attack vector (AV:N) prevents a lower score. However, the context of unsupported software and public exploits elevates operational risk beyond the numeric score; organizations should treat this as a medium-priority migration trigger rather than a low-priority patch.

Frequently asked questions