CVE-2026-9558

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-9558
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9558.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-9558
Aliases
Published
2026-05-29T10:01:36.019Z
Modified
2026-07-23T03:56:39.901003035Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9558.json",
    "cwe_ids": [
        "CWE-1336"
    ],
    "cna_assigner": "Mautic",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.3.0"
                },
                {
                    "fixed": "4.4.20"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/mautic/mautic

Affected ranges

Type
GIT
Repo
https://github.com/mautic/mautic
Events
Introduced
96b53794017cde917e1e4262ebaaae5099e3586a
Fixed
03865b3dfbe0064df47d176b897bbfe1ba60e1d3
Introduced
12f062e87dd1c470893724b12be7b623ecd22f2b
Fixed
bd92ad789274317c82f6e1e1179d56f7406bc702
Introduced
21ab270a3516635551d7464fc604f4e5e1ae3aea
Fixed
789364ee4aaf8aef5e6d91642336c1f446d5521b
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.2.11"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.9"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.1.2"
        }
    ]
}

Affected versions

5.*
5.0.0
5.1.0
5.2.0
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.8
5.2.9
6.*
6.0.0
6.0.0-alpha
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
7.*
7.0.0-alpha
7.0.0-beta
7.1.0
7.1.0-rc
7.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9558.json"