CVE-2026-9558: Mautic/core Mautic Has Server-Side Template Injection Vulnerability
CRITICALCVE-2026-9558 is a CRITICAL (CVSS 9.9) mautic has server-side template injection vulnerability (CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine) affecting Mautic/core libraries in the Packagist ecosystem. The issue involves mautic has server-side template injection (ssti) in theme templates. Remediation is available by upgrading affected packages to version 5.2.11, 6.0.9, 7.1.2.
CVE-2026-9558 at a Glance
Security Impact
CVSS: 9.9
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
How to Fix CVE-2026-9558
To remediate this vulnerability, upgrade all affected Mautic/core dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade mautic/core to Latest secure releaseUpgrade mautic/core to 5.2.11Upgrade mautic/core to 6.0.9Upgrade mautic/core to 7.1.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for mautic/coreHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-9558, inspect your project dependencies for Mautic/core:
inspect dependencies for mautic/coreAnalyze the terminal output to locate any version of Mautic/core in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.2.11), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine, where the product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. In Mautic/core, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-9558 Affected Mautic/core Versions
4 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
mautic/core
|
Packagist |
≥ 1.3.0
|
|
|
mautic/core
|
Packagist |
≥ 5.0.0
< 5.2.11
|
5.2.11
|
|
mautic/core
|
Packagist |
≥ 6.0.0
< 6.0.9
|
6.0.9
|
|
mautic/core
|
Packagist |
≥ 7.0.0
< 7.1.2
|
7.1.2
|
References
Frequently Asked Questions
What is CVE-2026-9558?
Which Mautic/core versions are affected?
What version fixes CVE-2026-9558?
Is mautic/core affected?
What is the CVSS score of CVE-2026-9558?
What CWE is associated with CVE-2026-9558?
How can I check Packagist dependencies for CVE-2026-9558?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-9fx4-7cmj-47vg",
"modified" : "2026-07-02T19:48:08Z",
"published" : "2026-07-02T19:48:08Z",
"aliases" : [ "CVE-2026-9558" ],
"summary" : "Mautic has Server-Side Template Injection (SSTI) in Theme Templates",
"details" : "### Summary\nA Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code.\n\n### Impact\nAn authenticated user with theme upload and creation privileges can bypass boundaries to execute arbitrary system commands on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.\n\n### Patched Versions\nThis security issue has been addressed in the following releases:\n* **7.1.2**\n* **6.0.9**\n* **5.2.11**\n\nFor users on Mautic 4.x, this fix is available in:\n* **4.4.20** via [ELTS](https://mautic.org/extended-long-term-support-elts/)\n\nMautic strongly recommend upgrading to a patched version immediately.\n\n### Workarounds\nThere are no official workarounds. To mitigate this vulnerability without upgrading, restrict theme upload and creation permissions (`core:themes:create`) to only highly trusted administrators.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "mautic/core"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.3.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "< 4.4.13"
}
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "mautic/core"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.0.0"
}, {
"fixed" : "5.2.11"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "mautic/core"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "6.0.0"
}, {
"fixed" : "6.0.9"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "mautic/core"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "7.0.0"
}, {
"fixed" : "7.1.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/mautic/mautic/security/advisories/GHSA-9fx4-7cmj-47vg"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-9558"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/mautic/mautic"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1336" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-02T19:48:08Z",
"nvd_published_at" : "2026-05-29T11:16:17Z"
}
}