NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Composer (PHP)

CVE-2026-9558: Mautic has Server-Side Template Injection (SSTI) in Theme Templates

criticalCVSS 3.1 9.9GHSA-9fx4-7cmj-47vg

Summary A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code.

Published Jul 2, 2026

Affected packages

mautic/core

Ecosystem
Composer (PHP)
Affected
>= 1.3.0, < 4.4.13
Fixed in
No patched version yet
Check
composer show mautic/core

mautic/core

Ecosystem
Composer (PHP)
Affected
>= 5.0.0, < 5.2.11
Fixed in
5.2.11
Check
composer show mautic/core

mautic/core

Ecosystem
Composer (PHP)
Affected
>= 6.0.0, < 6.0.9
Fixed in
6.0.9
Check
composer show mautic/core

mautic/core

Ecosystem
Composer (PHP)
Affected
>= 7.0.0, < 7.1.2
Fixed in
7.1.2
Check
composer show mautic/core

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code.

Impact

An authenticated user with theme upload and creation privileges can bypass boundaries to execute arbitrary system commands on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

Patched Versions

This security issue has been addressed in the following releases:

  • 7.1.2
  • 6.0.9
  • 5.2.11

For users on Mautic 4.x, this fix is available in:

Mautic strongly recommend upgrading to a patched version immediately.

Workarounds

There are no official workarounds. To mitigate this vulnerability without upgrading, restrict theme upload and creation permissions (core:themes:create) to only highly trusted administrators.

Credited to onurcangnc, xfer0, Entropt, patrykgruszka, escopecz, LeuchtfeuerDigitalMarketing, NumberOreo1.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Composer (PHP) vulnerabilities

All Composer (PHP) entries