Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue() calls shouldBeRenderedAsTwig(), which gates rendering only on the field definition's allow_twig flag and a regex checking for "{{", "{%", or "{#"; when true, the raw field value is compiled and rendered via "self::getTwig()->createTemplate($value)->render(['record' => $this->getContent()])" with no sandboxing. Bolt's own bundled config/bolt/contenttypes.yaml sets "allow_twig: true" on the default "pages" contenttype's content field out of the box. Any user with edit access to that content type (a standard editor role, not just an administrator) can inject a Twig payload such as "{{ ['id']|map('passthru')|join }}" that executes arbitrary OS commands when the content is saved and rendered, achieving remote code execution as the web server user.