CVE-2021-40219: Bolt CMS

High severity, CVSS 8.8. EPSS: 3.4% chance of exploitation in the next 30 days.

Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution.

Affected products

• Bolt Bolt CMS: up to and including 4.2.0

Published 2022-04-11. Last modified 2026-07-09.