CVE-2026-9558CWE-1336

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine

Critical · published May 29, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
55.8
In the wild
Unconfirmed
What it is

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00789 · 55.8th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2026-05-29T10:01Z
EPSS history
Timeline
  • 29 MAY 10:01Z
    A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine
    cvelistv5