PT-2026-44900 · Git · Bolt

Tonoss-412 · CVE-2026-39229 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bolt CMS versions prior to 3.7.1

Description An authenticated attacker with low-level privileges can perform SQL Injection via the order parameter on content listing pages. This issue occurs within the OrderDirective component and can be used to extract sensitive information.

Recommendations Update Bolt CMS to version 3.7.1 or later. As a temporary mitigation, restrict access to the content listing pages for low-privileged users.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-39229

Affected Products

Bolt

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39229.json · Exploit
• 🔥 https://github.com/Tonoss-412/My-CVE/blob/main/CVE-2026-39229.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39229 · Security Note
• https://osv.dev/vulnerability/CVE-2026-39229 · Vendor Advisory
• https://github.com/bolt/bolt · Note
• https://boltcms.io · Note
• https://t.me/cveNotify/209141 · Telegram Post