CVE-2026-9558: A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine

Synopsis

A server-side template injection vulnerability in Mautic's theme engine lets authenticated users upload Twig templates that render without a sandbox, allowing arbitrary code execution on the host. It is reachable over the network and requires only a low-privilege account that can create or upload themes, after which the attacker achieves full remote code execution and access to restricted files. Patched-image rebuilds at 4.4.20, 5.2.11, 6.0.9, and 7.1.2 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Mautic web interface over the network (AV:N).

• AuthenticationRequired

  A low-privilege Mautic account with theme create or upload permission is sufficient (PR:L).

• Victim interactionNot required

  No user must click or open anything; the attacker triggers rendering directly (UI:N).

• Attack complexityDetail

  Attack complexity is low: uploading a crafted Twig template reliably triggers execution without race conditions or environmental tuning (AC:L).

Blast Radius

• Executes arbitrary code on the Mautic host as the web application user, giving shell-level control of the container.
• Reads restricted system files, environment variables, database credentials, and Mautic configuration secrets.
• Modifies or deletes Mautic data including contacts, campaigns, and stored templates by writing through the compromised process.
• Disrupts or takes the Mautic service offline through destructive commands or resource exhaustion from the executed payload.