CVE-2026-9558
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions, allowing authenticated users with theme creation or upload permissions to achieve remote code execution (RCE) and access restricted system files and configuration.
Risk Assessment
The risk for the organization includes full compromise of the hosting server by an attacker, potentially leading to data theft, system modification, or further attacks on the infrastructure.
Recommendation
Immediately update Mautic to the latest patched version and restrict theme creation and upload permissions to trusted users only.
Original NVD description (English source)
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.