Mautic CVE-2026-115189

Requires an authenticated account with the core:themes:create permission, which in default installations is granted only to the Administrator role and may be delegated to other roles in multi-operator setups. The attacker must upload a malicious theme whose template is subsequently rendered; the Twig sandbox introduced for GHSA-9fx4-7cmj-47vg fails to fully enforce its restrictions, permitting the escape. The limiting factor is this privilege requirement (PR:L) - anonymous/unauthenticated users cannot exploit it - so realistic risk centers on malicious or compromised privileged operators rather than mass opportunistic attack. Affected: mautic/core >=1.3.0 <5.2.12, >=6.0.0 <6.0.10, >=7.0.0 <7.2.2; the only complete fix stated by the vendor is upgrading to 7.2.2, 6.0.10, or 5.2.12 (4.4 via ELTS). The vendor's non-upgrade mitigation is to restrict core:themes:create to trusted administrators and not delegate it to operator-level roles; there are no official workarounds beyond this.

This is a genuinely high-priority flaw, not a high-CVSS-but-low-real-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges, and the impact is full compromise (C:H/I:H/A:H) because the outcome is arbitrary code execution as the web server process. The vuln.today decision label is 'this_week', indicating elevated but not emergency urgency. The key limiting signal is PR:L: exploitation requires an authenticated account holding the core:themes:create permission, which by default is restricted to the Administrator role - so widespread opportunistic exploitation is less likely than the 8.8 score alone might suggest, and the realistic threat model is a malicious or compromised operator-level account, especially in multi-operator setups where theme creation is delegated. No EPSS score, no CISA KEV listing, and no PoC reference were provided in the input, so exploitation probability and in-the-wild activity cannot be assessed from the available data. One notable aggravating factor stated by the vendor: this is an INCOMPLETE fix for the prior GHSA-9fx4-7cmj-47vg sandbox, meaning a previously-patched sandbox is again bypassable - attackers aware of the earlier issue have a strong starting point.

An authenticated Mautic user holding the core:themes:create permission (by default an administrator, or a delegated operator in multi-operator deployments) uploads a crafted Twig theme template that escapes the rendering sandbox. When that theme is later rendered, the embedded template injection executes arbitrary OS commands as the web server process, letting the attacker read configuration files and database credentials, write files, and pivot to internal services. No public exploit was identified in the provided input, but the vendor confirms this is an incomplete fix for the earlier GHSA-9fx4-7cmj-47vg sandbox escape.