CVE-2026-9558

The record

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

Affected packages

Related vulnerabilities

• CVE-2026-107264 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
• CVE-2026-107259 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
• CVE-2026-61707 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-1336
• CVE-2026-119144 Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template… CWE-1336
• CVE-2026-118803 Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection… CWE-1336
• CVE-2026-115223 The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent… CWE-1336
• CVE-2026-115938 Craft CMS allows any authenticated control panel user to submit an element-search… CWE-1336
• CVE-2026-55486 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-1336