GHSA-9fx4-7cmj-47vg CVE-2026-9558
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
- Severity
- 9.9 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 0.57%
- Chance of exploitation in the next 30 days. Higher than 47.25% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
- Fix
5.2.11- Upgrade mautic/core to this version or later
Description
Summary
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code.
Impact
An authenticated user with theme upload and creation privileges can bypass boundaries to execute arbitrary system commands on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.
Patched Versions
This security issue has been addressed in the following releases:
- 7.1.2
- 6.0.9
- 5.2.11
For users on Mautic 4.x, this fix is available in:
- 4.4.20 via ELTS
Mautic strongly recommend upgrading to a patched version immediately.
Workarounds
There are no official workarounds. To mitigate this vulnerability without upgrading, restrict theme upload and creation permissions (core:themes:create) to only highly trusted administrators.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| mautic/core | >= 1.3.0 |
No fix yet |
| mautic/core | >= 5.0.0, < 5.2.11 |
5.2.11 |
| mautic/core | >= 6.0.0, < 6.0.9 |
6.0.9 |
| mautic/core | >= 7.0.0, < 7.1.2 |
7.1.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
mautic/core Packagist → 5.2.11
- composer
composer require mautic/core:^5.2.11
Severity breakdown
CVSS 3.1 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
How to prevent it
- Architecture and Design: Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
- Implementation: Use the template engine's sandbox or restricted mode, if available.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5hvg-w58j-545m Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector | Medium | Also affects mautic/core |
| GHSA-7h65-whp7-rgqf Mautic has Stored Cross-Site Scripting (XSS) in Projects Component | High | Also affects mautic/core |
| GHSA-2jrw-c95w-h43g Mautic has an Authorization Bypass in API v2 Endpoints | High | Also affects mautic/core |
| GHSA-6r9h-4h75-7q4x Mautic vulnerable to Path Traversal via Campaign Import | Critical | Also affects mautic/core |
| GHSA-jmv8-8j9j-rcpc Mautic Focus component Vulnerable to SSRF | Medium | Also affects mautic/core |
| GHSA-fcmw-wx57-9p75 Mautic has SQL Injection in API Contact Filtering | High | Also affects mautic/core |
| GHSA-r5j5-q42h-fc93 Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting | High | Also affects mautic/core |
| GHSA-3fq7-c5m8-g86x Mautic user without privileged access to the Marketplace can install and uninstall composer packages | Critical | Also affects mautic/core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor