PT-2026-44802 · Mautic · Mautic

Daniel Zhang + 4 · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-9558

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mautic (affected versions not specified)

Description A Server-Side Template Injection (SSTI) issue exists in the theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can exploit this to achieve Remote Code Execution (RCE), allowing the execution of arbitrary code on the hosting server, or to access restricted system files and configuration settings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-9558

Affected Products

Mautic

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-9558 · Security Note
• https://github.com/mautic/mautic/security/advisories/GHSA-9fx4-7cmj-47vg · Note
• https://reddit.com/r/pwnhub/comments/1tr2kvb/critical_vulnerability_in_mautic_could_allow · Reddit Post
• https://t.me/cveNotify/165170 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2060343387761360913 · Twitter Post