Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-9558: Mautic Theme Engine Allows Malicious Code Execution
CVE-2026-9558
GHSA-9fx4-7cmj-47vg
Summary
Mautic's theme engine is vulnerable to attacks that can execute malicious code on the hosting server. This is a risk because an authenticated user with permission to upload themes can potentially harm the server or access sensitive data. To protect your server, update Mautic to the latest version or restrict permissions for theme uploads.
What to do
- Update mautic core to version 5.2.11.
- Update mautic core to version 6.0.9.
- Update mautic core to version 7.1.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | mautic | core |
>= 1.3.0, < 4.4.13 >= 5.0.0, < 5.2.11 >= 6.0.0, < 6.0.9 >= 7.0.0, < 7.1.2 Fix: upgrade to 5.2.11
|
Original title
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
Original description
### Summary
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code.
### Impact
An authenticated user with theme upload and creation privileges can bypass boundaries to execute arbitrary system commands on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.
### Patched Versions
This security issue has been addressed in the following releases:
* **7.1.2**
* **6.0.9**
* **5.2.11**
For users on Mautic 4.x, this fix is available in:
* **4.4.20** via [ELTS](https://mautic.org/extended-long-term-support-elts/)
Mautic strongly recommend upgrading to a patched version immediately.
### Workarounds
There are no official workarounds. To mitigate this vulnerability without upgrading, restrict theme upload and creation permissions (`core:themes:create`) to only highly trusted administrators.
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code.
### Impact
An authenticated user with theme upload and creation privileges can bypass boundaries to execute arbitrary system commands on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.
### Patched Versions
This security issue has been addressed in the following releases:
* **7.1.2**
* **6.0.9**
* **5.2.11**
For users on Mautic 4.x, this fix is available in:
* **4.4.20** via [ELTS](https://mautic.org/extended-long-term-support-elts/)
Mautic strongly recommend upgrading to a patched version immediately.
### Workarounds
There are no official workarounds. To mitigate this vulnerability without upgrading, restrict theme upload and creation permissions (`core:themes:create`) to only highly trusted administrators.
nvd CVSS3.1
9.9
Vulnerability type
CWE-1336
Published: 2 Jul 2026 · Updated: 23 Jul 2026 · First seen: 29 May 2026