Mautic Core: Server-side template injection in theme rendering sandbox
Summary
A server-side template injection flaw in the Twig theme rendering sandbox of Mautic allows a crafted theme template to escape the sandbox. This is an incomplete fix for GHSA-9fx4-7cmj-47vg (CVE-2026-9558). An authenticated user with the core:themes:create permission can upload a malicious theme and execute arbitrary code on the server as the web server process, which allows reading configuration files and database credentials, writing files and reaching internal services.
Affected
- mautic/core from 1.3.0 to before 5.2.12
- mautic/core from 6.0.0 to before 6.0.10
- mautic/core from 7.0.0 to before 7.2.2
- Mautic 4.x: Unknown (the fix for 4.4 is distributed via ELTS only)
Fixed in
- 5.2.12
- 6.0.10
- 7.2.2
- Mautic 4.4: fix available only via ELTS from the vendor; version not named in the advisory
Workaround
- No official workarounds exist.
- Restrict the core:themes:create permission to trusted administrator accounts only.
- Do not delegate theme creation to operator-level roles.
Exploitation
- Authentication required: a valid account with core:themes:create is needed (CVSS PR:L).
- CISA SSVC: exploitation none, not automatable.
- No confirmed exploitation in the wild found at the time of research.
- A public proof of concept is reported by one unverified source and has not been confirmed.
Our recommendation
- Identify all Mautic installations and their versions, including any 4.x instances.
- Upgrade to 5.2.12, 6.0.10 or 7.2.2 as applicable; for 4.x obtain the ELTS fix from the vendor.
- Until the upgrade is done, restrict core:themes:create to named, trusted administrators and enforce MFA on admin accounts.
- Review uploaded themes and admin activity logs for unexpected theme uploads.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-h7pm-79gc-8867 github.com
- Mautic 5.2.12 release github.com
- Predecessor advisory GHSA-9fx4-7cmj-47vg github.com
- Fix PR for 6.0 github.com
- Fix PR for 5.2 github.com
- Fix PR for 7.2 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:33.
Original description (NVD)
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.