Vulnerability · Published May 29, 2026 · Assigned by Mautic
CVE-2026-9558
Critical 9.9
In plain English
A critical-severity security flaw in mautic/core. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | mautic/core | no fix listed | GHSA-9fx4-7cmj-47vg |
| Packagist | mautic/core | 5.2.11 | GHSA-9fx4-7cmj-47vg |
| Packagist | mautic/core | 6.0.9 | GHSA-9fx4-7cmj-47vg |
| Packagist | mautic/core | 7.1.2 | GHSA-9fx4-7cmj-47vg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mautic/core | 1.3.0 – before 4.4.205.0.0 – before 5.2.116.0.0 – before 6.0.97.0.0 – before 7.1.2 |
Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H