What is the CVSS score of CVE-2026-9558?

CVE-2026-9558 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-9558?

Yes, a patch is available for CVE-2026-9558. Update the affected software to the latest version immediately.

Mautic CVE-2026-9558

EUVD-2026-33276 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-05-29 Mautic

GHSA-9fx4-7cmj-47vg

RCE Ssti

9.9

CVSS 3.1 · Vendor: Mautic

Severity by source

Vendor (Mautic) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (Mautic) · only source for this CVE.

CVSS VectorVendor: Mautic

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

CRITICAL 9.9

Analysis Generated

May 29, 2026 - 11:00 vuln.today

DescriptionCVE.org

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

AnalysisAI

Server-Side Template Injection in Mautic's theme engine allows authenticated users with theme creation or upload permissions to execute arbitrary code on the host. Because the platform renders uploaded Twig templates without a sandbox or strict function allowlist, an attacker who already holds theme-management rights can pivot from administrative content control to full server compromise, including reads of restricted system files and configuration. No public exploit identified at time of analysis, and the issue has not been listed in CISA KEV.

Technical ContextAI

Mautic is an open-source marketing automation platform that uses the Twig templating engine (a Symfony-ecosystem template language) to render themes. The flaw maps to CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), meaning the theme renderer evaluates user-supplied Twig markup outside Twig's sandbox extension and without restricting dangerous functions/filters such as filter, map, or PHP callable bridges. Twig is normally safe only when the SandboxExtension is enabled with an allowlist of tags, filters, and methods; without it, Twig expressions can reach arbitrary PHP, which is why uploaded theme files become a direct path to OS-level code execution and arbitrary file disclosure on the web server.

Affected ProductsAI

The affected product is Mautic, the open-source marketing automation platform maintained by the Mautic project; the vulnerability resides in the theme engine that renders uploaded Twig templates. Specific fixed and vulnerable version ranges were not enumerated in the supplied data and no CPE strings were provided, so administrators should consult the vendor's GitHub Security Advisory at https://github.com/mautic/mautic/security/advisories/GHSA-9fx4-7cmj-47vg for the authoritative version matrix.

RemediationAI

Patch available per vendor advisory - upgrade Mautic to the fixed release identified in GHSA-9fx4-7cmj-47vg at https://github.com/mautic/mautic/security/advisories/GHSA-9fx4-7cmj-47vg, applying the exact patched version listed there as the primary remediation. Until upgrade, restrict the 'create themes' and 'upload themes' permissions to a minimal set of fully trusted administrators and audit existing role assignments, accepting the trade-off that legitimate theme designers will lose self-service ability. As compensating controls, disable theme upload entirely if unused, place the Mautic web root behind tighter filesystem permissions and a hardened PHP configuration (disable_functions for exec/passthru/system, open_basedir scoped to Mautic), and monitor the themes directory for new or modified Twig files; note these reduce blast radius but do not close the SSTI sink itself.