Server-Side Template Injection Vulnerability in Mautic's Theme Engine
CVE-2026-9558

9.9CRITICAL

Key Information:

Status
Vendor
CVE Published:
29 May 2026

What is CVE-2026-9558?

A critical vulnerability in Mautic's theme engine allows authenticated users to upload and execute potentially malicious Twig templates. This design flaw grants users with theme upload permissions an opportunity to execute arbitrary code on the hosting server, thereby compromising system integrity. Without strict function restrictions or sandboxing in place, attackers can exploit this vulnerability to gain unauthorized access to sensitive configuration settings and system files.

References

https://github.com/mautic/mautic/security/advisories/GHSA...

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Onurcan Genç (@onurcangnc)
Daniel Zhang (@xfer0)
Tuan Do (@Entropt)
Patryk Gruszka (@patrykgruszka)
John Linhart (@escopecz)
Leuchtfeuer Digital Marketing (@Leuchtfeuer)
.