External risk intelligence

Mautic Theme Engine Server-Side Template Injection Leads to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-9558

Mautic is a marketing automation platform that can be internet-facing, but the vulnerability requires authenticated access to the theme engine. While the application itself may be exposed, this specific attack surface is restricted to authenticated users with specific permissions, making it less likely to be exploited by a random internet actor compared to pre-authentication edge services.

Remote Code Execution

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Mautic's theme engine could allow authenticated users to execute arbitrary code or access sensitive system information. This issue arises from the platform's handling of uploaded templates, which are rendered without proper security restrictions. The main concern is to confirm if your Mautic instance is affected and assess potential exposure.

Users can run any code on the server.
Critical for maintaining system security and integrity.
Verify Mautic's theme upload and use.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to create or upload themes in Mautic can exploit a weakness in how the platform handles Twig templates. By uploading a specially crafted template, an attacker can bypass security measures designed to prevent malicious code execution and achieve arbitrary code execution on the server or access sensitive system information.

Authenticated user with theme permissions.
Uploading a malicious Twig template.
Arbitrary code execution and data access.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, authenticated users with theme creation privileges could execute arbitrary code on the hosting server or access restricted system files and configuration settings due to the platform rendering uploaded Twig templates without proper sandboxing.

Hosting server and system files.
Unrestricted template rendering.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This Server-Side Template Injection vulnerability in Mautic's theme engine impacts users with permissions to create or upload themes, enabling arbitrary code execution on the hosting server or access to sensitive files. Identifying affected Mautic instances, confirming exposure, and locating the accountable owner are critical first steps. Remediation planning should prioritize high-risk, business-critical deployments.

Theme owners and infrastructure teams own this issue.
Verify Mautic instance reachability and critical assets.
Plan remediation based on asset criticality and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Mautic?

Mautic is an open-source marketing automation platform designed to manage email campaigns, track user behavior, and automate lead nurturing. Organizations use it to deliver personalized content across various digital channels. At its core, the software includes a theme engine that utilizes the Twig template language, allowing users to customize the visual appearance and layout of their marketing communications and landing pages.

What does CVE-2026-9558 mean by Server-Side Template Injection?

This vulnerability is classified as CWE-1336, which refers to Improper Neutralization of Special Elements Used in a Template Engine. In Mautic, it means the system processes uploaded Twig templates without sufficient security controls or sandboxing. Because the engine does not restrict what the code can do, a malicious template can trick the server into running unauthorized commands or exposing private configuration files instead of just rendering a webpage.

How is this Mautic vulnerability triggered?

An attacker must have an account with specific privileges to create or upload themes to the Mautic instance to trigger this flaw. Simply visiting the website or interacting with public-facing forms is not enough to execute the attack. If a user lacks the permissions required to modify the theme engine's configuration or upload new template files, they cannot leverage this specific vulnerability.

Is my Mautic instance at risk?

According to Halo Surface Signal, while Mautic instances are often internet-facing, this vulnerability is not triggered by a random visitor. The risk is highest for organizations where untrusted users are granted theme-editing permissions. Because the attack surface is limited to authenticated users, internal access controls and user role management are primary factors in determining your actual exposure level.

Do I need to take action if I run Mautic?

Yes. Start by identifying all Mautic instances in your environment and auditing which user accounts currently possess theme upload or creation permissions. Determine who owns these assets and coordinate with them to restrict these capabilities until you can apply official updates. Prioritize your most critical deployments that hold sensitive customer data when planning your mitigation strategy.

References

github.com/mautic/mautic/security/advisories/GHSA-9fx4-7cmj-47vg

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.