VulnerabilityDeferred

CVE-2026-9558

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine.

CRITICAL 9.9EPSS 0.57%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.57%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

CVSS 3.1: 9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.57% probability · 45th percentile
CISA KEV: Not listed
Weakness: CWE-1336
Source: security@mautic.org

References

https://github.com/mautic/mautic/security/advisories/GHSA-9fx4-7cmj-47vg

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.