Mautic CVE-2026-9558: Brief Summary of Critical SSTI to RCE in the Theme Engine

Introduction

An architectural gap in Mautic's theme engine lets authenticated users reach full Remote Code Execution on the hosting server. They upload crafted Twig templates, and the platform renders them without any sandbox restrictions. With a CVSS score of 9.9 and over 40,000 websites running Mautic across 85 countries, CVE-2026-9558 is a serious exposure for organizations that rely on the platform for marketing automation.

Mautic is the first open source marketing automation platform, founded in 2014 and acquired by Acquia in 2019. It is the leading open source alternative to proprietary platforms like HubSpot and Marketo, and it has been recognized as a Digital Public Good. Mautic runs in a lot of marketing departments, many of which lack dedicated security teams, which makes this vulnerability worth paying attention to.

Technical Information

Root Cause: Unsandboxed Twig Template Rendering

CVE-2026-9558 is classified under CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine. Per MITRE, this CWE applies when a product "uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine."

Mautic uses the Twig templating engine (a PHP based template engine) to render theme templates. The core issue is that Mautic passes user supplied template content straight to the Twig rendering engine without enabling Twig's sandbox extension or imposing strict function restrictions. Any Twig directive embedded in a theme template is then evaluated with the full capabilities of the Twig engine, including access to PHP internals.

CVSS Vector Decomposition

The CVSS v3.1 vector string is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which breaks down as follows:

The Scope Changed component matters here: exploiting the Mautic application can compromise the underlying hosting server itself, not just the application. Containerized or shared hosting deployments where the server hosts other workloads face a larger blast radius.

Attack Flow

The exploitation sequence, based on the GitHub advisory, proceeds as follows:

1. Authentication: The attacker obtains an authenticated Mautic session with the core:themes:create permission. In typical deployments, this permission is granted to administrators and designated theme designers, but misconfigured installations may extend it more broadly.

2. Theme Upload: The attacker uploads or creates a theme containing a Twig template file with malicious directives embedded in {{ }} expression blocks.

3. Template Processing: When Mautic renders the theme, it processes the template through Twig without enabling the sandbox extension.

4. Object Graph Traversal: Twig evaluates the injected directives, letting the attacker traverse the PHP object graph. Common techniques include accessing _self.env.registerUndefinedFilterCallback or similar Twig internals to reach PHP execution functions.

5. Code Execution: The attacker calls system(), exec(), or similar PHP functions, achieving arbitrary operating system command execution with the privileges of the web server process.

This attack pattern, Server-Side Template Injection leading to RCE via Twig, is well documented. James Kettle's foundational Black Hat research paper established the exploitation methodology, noting that "unsafely embedding user input in templates enables Server-Side Template Injection, a vulnerability class which can be exploited to inject arbitrary code into the server-side template engine."

The same pattern has been demonstrated in other platforms:

• Kimai (GHSA-fjhg-96cp-6fcw): "a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities"
• Grav CMS (GHSA-662m-56v4-3r8f): "SSTI vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute" arbitrary code

Dual Impact: RCE and File Access

Beyond Remote Code Execution, the advisory notes the vulnerability can also be used to "access restricted system files and configuration settings." Even without code execution, an attacker can use Twig's file system functions (such as file_get_contents, reachable through the unsandboxed engine) to read sensitive files, including /etc/passwd, database configuration files, Mautic's local.php configuration, and environment variables. That information leakage alone can enable lateral movement, credential theft, and further compromise.

Affected Systems and Versions

Based on the GitHub advisory, all Mautic versions prior to the following patched releases are affected:

Any Mautic installation running a version older than the patched release for its branch is vulnerable. Organizations on versions older than 4.x have no patched release available and must upgrade to a supported branch.

The vulnerability affects installations where any user holds the core:themes:create permission, which grants the ability to create or upload themes. Any Mautic instance that exposes an admin or theme authoring interface to the network is at risk.

Vendor Security History

Mautic's security history shows a recurring pattern of critical vulnerabilities, particularly ones that enable Remote Code Execution. CVE-2026-9558 is at least the third critical RCE class vulnerability in Mautic in a two year span:

CVE-2024-47051 is a useful precedent. SonicWall documented that "this vulnerability arises due to a logical flaw in the sanitization process of the file upload functionality," and a public proof of concept exploit was published on GitHub showing that "an authenticated attacker can write arbitrary PHP code inside the web directory." Public exploit code for a prior Mautic RCE raises the odds that CVE-2026-9558 will get public exploit tooling too.

The pattern across these vulnerabilities is consistent: each exploits a different input handling surface (asset uploads, file uploads, template rendering), but the underlying issue is a systemic weakness in input validation and code execution barriers within the platform's architecture. Mautic's security team does respond with patches across all supported branches and publishes detailed advisories, but the frequency of critical findings points to architectural rather than isolated flaws.

Horizon3.ai published a detailed technical writeup on the unauthenticated XSS to RCE chain, and the Belgium Cybersecurity Centre (CCB) issued an advisory on Mautic's authorization vulnerabilities. National level cyber authorities are tracking Mautic as a risk vector.

Threat Intelligence Context

As of the publication date (May 29, 2026), no evidence was found that CVE-2026-9558 is being actively exploited in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog, and no threat intelligence reports specifically reference exploitation of this CVE.

Several factors suggest active exploitation is probable in the near term:

Detailed public advisory: The GitHub advisory describes the vulnerability mechanism (Twig templates without sandbox), the attack requirement (core:themes:create permission), and the impact (RCE). That is enough for an experienced attacker to develop a working exploit.

Precedent of public exploit code: As noted above, CVE-2024-47051 received a full public PoC on GitHub shortly after disclosure. The same outcome is likely given the similar attack surface.

Large target population: With over 40,000 websites running Mautic across 85 countries, the target population is substantial. Many of these are marketing departments that may not have dedicated security teams or rapid patching cycles.

Time to exploit compression: Per Mondoo's 2026 State of Vulnerabilities report, "2025 saw 48K+ CVEs published (21% YoY growth), 193K malware packages, and time-to-exploit collapsed to just 5 days." The window between CVE publication and weaponized exploitation is shrinking industry wide.

SSTI as a broader trend: CVE-2026-9558 is not an isolated incident. Server-Side Template Injection through Twig and other engines has become a significant vulnerability class across many web applications in 2025 and 2026:

• Craft CMS: Authenticated RCE via Twig SSTI (March 2026)
• Grav CMS: SSTI through Twig sandbox bypass (December 2025)
• JumpServer: SSTI in YAML processing leading to RCE (March 2026)
• Infiniflow RAGFlow: SSTI leading to RCE (March 2026)

This cluster suggests template engine security is a systemic blind spot across the PHP and Python web application ecosystem. Attackers who build SSTI exploitation tooling for one platform can readily adapt it to others using the same engine, which makes Mautic a likely target.

Closing Analysis

There is a real tension between Mautic's responsive patching (covering four release branches at once) and the recurring discovery of new RCE vectors. The security team is reactive and thorough, but the platform's architecture, which lets user supplied code reach execution contexts without sufficient sandboxing, keeps producing new critical findings. Until Mautic adopts a default deny approach to code execution in user controllable surfaces (sandboxed Twig rendering, strict file upload allowlists, and template content validation), further critical CVEs are probable.

The advisory states that no official workaround exists. The only interim mitigation is restricting the core:themes:create permission to highly trusted administrators. Organizations that cannot upgrade right away should audit and lock down theme creation permissions, review all installed custom themes for suspicious Twig directives, and consider running Mautic in a containerized environment with restricted OS level privileges to limit the blast radius of a successful exploit.

The absence of active exploitation at time of publication should not delay action. Given the detailed public advisory, the large install base, prior public exploit code for a related Mautic RCE, and the industry wide compression of time to exploit to roughly 5 days, the window for pre emptive patching is measured in days, not weeks.

References

• NVD: CVE-2026-9558
• GitHub Advisory: GHSA-9fx4-7cmj-47vg (Server-Side Template Injection in Theme Templates)
• CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
• Mautic Security Page
• Mautic GitHub Security Policy
• James Kettle: Server-Side Template Injection: RCE for the Modern Web App (Black Hat)
• Kimai SSTI to RCE Advisory (GHSA-fjhg-96cp-6fcw)
• Grav CMS SSTI Sandbox Bypass Advisory (GHSA-662m-56v4-3r8f)
• Craft CMS Twig SSTI Advisory (GHSA-94rc-cqvm-m4pw)
• JumpServer SSTI Advisory (GHSA-qx8h-rx2j-j5wc)
• Infiniflow RAGFlow SSTI Advisory (GHSA-vvwj-fvwh-4whx)
• Mautic RCE and File Deletion in Asset Uploads (GHSA-73gx-x7r9-77x2)
• SonicWall: Critical Mautic Vulnerability CVE-2024-47051
• Horizon3.ai: Unauthenticated XSS to RCE Chain in Mautic
• Public PoC for CVE-2024-47051 (mallo-m)
• NVD: CVE-2024-47053
• Belgium CCB Advisory on Mautic Authorization Vulnerabilities
• Acquia Acquires Mautic
• Mautic: 10 Years of Community-Powered Marketing Automation
• CISA Known Exploited Vulnerabilities Catalog
• Mondoo: 2026 State of Vulnerabilities Report