CVE-2026-9558: Mautic Theme Engine SSTI RCE Vulnerability

CVE-2026-9558 Overview

CVE-2026-9558 is a Server-Side Template Injection (SSTI) vulnerability in the Mautic marketing automation platform. The flaw resides in Mautic's theme engine, which renders uploaded Twig templates without sandboxing or function restrictions. Authenticated users with theme creation or upload permissions can inject malicious Twig syntax to achieve Remote Code Execution (RCE) on the underlying host. Attackers can also read restricted system files and access sensitive configuration data. The weakness is tracked under CWE-1336, Improper Neutralization of Special Elements Used in a Template Engine.

Critical Impact
Authenticated attackers with theme upload privileges can execute arbitrary PHP code on the Mautic host, leading to full server compromise, data exfiltration, and lateral movement.

Affected Products

Mautic marketing automation platform (theme engine component)
Self-hosted Mautic instances permitting authenticated theme uploads
Mautic deployments where non-administrative users hold theme management roles

Discovery Timeline

2026-05-29 - CVE-2026-9558 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-9558

Vulnerability Analysis

Mautic renders theme files using the Twig templating engine. The engine is invoked without Twig\Sandbox\SecurityPolicy constraints, and no allowlist limits the functions, filters, or tags available inside uploaded templates. An authenticated user who uploads a theme can embed Twig expressions that call PHP functions through Twig's filter, function, or object access mechanisms.

When Mautic renders the uploaded theme, the engine evaluates attacker-controlled expressions in the context of the web server process. The vulnerability is exploitable over the network against the Mautic web interface and requires only low-privilege authenticated access. The scope is changed because code executes in the PHP runtime hosting Mautic, allowing the attacker to interact with the operating system beyond the application boundary.

Root Cause

The root cause is the absence of a Twig sandbox policy and missing input validation on theme files. Mautic trusts uploaded .twig content as if it were authored by a developer, despite exposing the upload surface to lower-privileged roles. Without function restrictions, expressions inside template files reach into PHP internals.

Attack Vector

An authenticated user with the theme:themes:create or upload permission packages a malicious theme containing Twig expressions that invoke PHP functions such as system, exec, or file_get_contents. The user uploads the archive through the theme manager. When Mautic renders the theme for preview or activation, the embedded expressions execute. The result is arbitrary command execution as the web server user and disclosure of files such as local.php, .env, or /etc/passwd.

Technical details are documented in the Mautic GitHub Security Advisory GHSA-9fx4-7cmj-47vg.

Detection Methods for CVE-2026-9558

Indicators of Compromise

Unexpected .twig files in themes/ directories containing function calls, object lookups, or {{ ... }} expressions referencing PHP internals
Web server child processes spawning shells (sh, bash, cmd.exe) or system utilities (curl, wget, nc) from the PHP-FPM or Apache process tree
Outbound connections from the Mautic host to unfamiliar IP addresses immediately after a theme upload or activation event
Audit log entries showing theme creation or upload actions from non-administrative accounts followed by file system writes outside the themes directory

Detection Strategies

Monitor the Mautic application audit log for theme.create, theme.upload, and theme.activate events and correlate them with subsequent process execution on the host
Inspect uploaded theme archives for Twig expressions that reference _self, getEnvironment, registerUndefinedFilterCallback, or PHP function names
Apply file integrity monitoring to the Mautic themes/ and app/config/ directories to surface unexpected modifications

Monitoring Recommendations

Forward Mautic application logs, web server access logs, and host process telemetry into a central analytics platform for correlation
Alert on PHP interpreter processes spawning shell binaries or network clients, which is anomalous for a marketing application
Review role assignments quarterly to identify users with theme management permissions and remove unnecessary grants

How to Mitigate CVE-2026-9558

Immediate Actions Required

Restrict the theme creation and upload permissions to a small set of trusted administrators until a patched release is deployed
Audit existing themes for unauthorized Twig expressions and remove any files that were not authored by the operations team
Rotate Mautic credentials, API tokens, and any secrets stored in local.php or environment files that may have been exposed
Place the Mautic administrative interface behind a VPN or IP allowlist to reduce the authenticated attack surface

Patch Information

Mautic has published remediation guidance in the GitHub Security Advisory GHSA-9fx4-7cmj-47vg. Administrators should upgrade to the fixed Mautic release referenced in that advisory, which enforces a Twig sandbox policy and restricts the functions available inside theme templates.

Workarounds

Revoke theme upload and creation permissions for all roles except a dedicated administrator role
Disable theme uploads entirely by removing write access to the themes/ directory at the file system level until the patch is applied
Run the PHP worker under a low-privileged operating system account with no shell, no sudo rights, and read-only access to configuration files
Deploy a web application firewall rule that blocks theme archive uploads containing Twig meta-syntax such as {{, {%, or references to _self

bash

# Example: restrict the Mautic themes directory to read-only for the web user
sudo chown -R root:www-data /var/www/mautic/themes
sudo find /var/www/mautic/themes -type d -exec chmod 750 {} \;
sudo find /var/www/mautic/themes -type f -exec chmod 640 {} \;

# Verify no writable theme files remain accessible to the PHP worker
sudo -u www-data find /var/www/mautic/themes -writable