CVE-2026-9558

CVSS 9.9 CRITICALEPSS 0.4%CWE-1336

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.9EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

29 May 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

mautic/core

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/mautic/mautic/security/advisories/GHSA-9fx4-7cmj-47vg