Mautic CVE-2026-9558

Exploitation requires an authenticated Mautic account that holds permission to create or upload themes (PR:L in the CVSS vector), and the attacker must be able to reach the Mautic web interface over the network - no user interaction by another victim is needed. The limiting factors are this theme-management privilege and the existence of the theme upload/rendering feature in the deployed Mautic configuration; instances that restrict theme rights to a narrow administrator group, or that have disabled theme uploads, materially reduce who can trigger the SSTI. No specific OS, platform, or non-default toggle beyond standard Mautic theme functionality is required.

The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9, reflecting network reach, low complexity, low-privilege authenticated abuse, no user interaction, and a changed scope with full CIA impact - appropriate given that an authenticated theme operator can escape Mautic's trust boundary into the underlying OS. Real-world priority is high for any Mautic instance that delegates theme/upload rights beyond a small set of trusted administrators, but the PR:L precondition meaningfully narrows mass-exploitation risk compared to an unauthenticated RCE. EPSS data was not provided in the input, the CVE is not in CISA KEV, and no public PoC is referenced, so this is best treated as a high-severity authenticated RCE rather than an active-exploitation emergency; defenders should still patch promptly because credential theft or a malicious insider with theme rights converts directly into full host compromise.

An attacker obtains or is granted a Mautic account with theme creation/upload rights - for example through credential reuse, a phishing-acquired marketer account that was over-privileged, or a malicious contractor. They craft a Twig template containing an SSTI payload that invokes PHP via the unsandboxed renderer, upload it as part of a theme, and trigger rendering to execute shell commands as the web server user, leading to webshell installation, configuration/secret exfiltration, and lateral movement.