CVE-2026-9558

At a glance

Severity: CRITICAL 9.9
EPSS: EPSS 0.57 % · percentile 47 (2026-10-27)
State: PUBLISHED
Published: 2026-05-29
Updated: 2026-05-29
Assigner: Mautic
NVD status: Deferred

Description

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Mautic
CVSS 3.1	CRITICAL 9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	NVD · security@mautic.org (Secondary)

Weaknesses (CWE)

CWE-1336

Advisories

GHSA-9fx4-7cmj-47vg — Mautic has Server-Side Template Injection (SSTI) in Theme Templates

European references

ENISA EUVD · EUVD-2026-33276
GCVE · GCVE-0-2026-9558

Affected products

Product	Versions
mautic/core	affected 1.3.0 < 4.4.20 ; affected 5.0.0 < 5.2.11 ; affected 6.0.0 < 6.0.9 ; affected 7.0.0 < 7.1.2

References

https://github.com/mautic/mautic/security/advisories/GHSA-9fx4-7cmj-47vg

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD