CVE-2026-9558: Critical severity Mautic Mautic vulnerability
Summary A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code.
Impact An authenticated user with theme upload and creation privileges can bypass boundaries to execute arbitrary system commands on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.
Patched Versions This security issue has been addressed in the following releases: 7.1.2 6.0.9 5.2.11
For users on Mautic 4.x, this fix is available in: 4.4.20 via ELTS
Mautic strongly recommend upgrading to a patched version immediately.
Workarounds There are no official workarounds. To mitigate this vulnerability without upgrading, restrict theme upload and creation permissions (core:themes:create) to only highly trusted administrators.
Other sources
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mautic/coreto a version that resolves this vulnerability.Fixed in 7.1.2 - Upgrade
Upgrade
composer/mautic/coreto a version that resolves this vulnerability.Fixed in 6.0.9 - Upgrade
Upgrade
composer/mautic/coreto a version that resolves this vulnerability.Fixed in 5.2.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.4.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.2.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.1.2 - Configuration
To mitigate without upgrading, restrict theme upload and creation permissions (core:themes:create) to only highly trusted administrators.
Mautic theme engine core:themes:create = restricted to only highly trusted administrators
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9558?
The severity of CVE-2026-9558 is critical, with a CVSS score of 9.9.
How do I fix CVE-2026-9558?
To fix CVE-2026-9558, update Mautic to the latest version that addresses the Server-Side Template Injection vulnerability.
What impact does CVE-2026-9558 have on Mautic users?
CVE-2026-9558 allows authenticated users with theme upload permissions to execute arbitrary code on the host.
Who is affected by CVE-2026-9558?
Any users of Mautic with the ability to create or upload themes are potentially affected by CVE-2026-9558.
What type of vulnerability is CVE-2026-9558?
CVE-2026-9558 is classified as a Server-Side Template Injection (SSTI) vulnerability.