Server-side template injection in Mautic Twig theme sandbox
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1336.
Summary
Mautic core, from 1.3.0 before 5.2.12, from 6.0.0 before 6.0.10, and from 7.0.0 before 7.2.2, contains a server-side template injection flaw in the Twig theme rendering sandbox. The sandbox meant to restrict uploaded theme templates does not fully enforce its restrictions, so a crafted theme template can escape it (CWE-1336). An authenticated user with the core:themes:create permission can upload such a theme and run arbitrary code on the server with the privileges of the web server process. This is an incomplete fix for GHSA-9fx4-7cmj-47vg.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | mautic/core | 1.3.0 to before 5.2.12; 6.0.0 to before 6.0.10; 7.0.0 to before 7.2.2 | 5.2.12, 6.0.10, 7.2.2 | Patch available | CNA |
- mautic/core Vendor— Affected 1.3.0 to before 5.2.12; 6.0.0 to before 6.0.10; 7.0.0 to before 7.2.2 Fixed in 5.2.12, 6.0.10, 7.2.2 Patch available CNA
Remediation
Upgrade mautic/core to 5.2.12, 6.0.10 or 7.2.2, depending on the release line in use. In default installations the core:themes:create permission belongs to the Administrator role, so review which roles hold it.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA mautic/core Fixed in 5.2.12, 6.0.10, 7.2.2
Timeline
- 2026-10-26 Threatist record created from CVE-2026-115189
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-26 Priority changed: MEDIUM → LOW
- 2026-10-27 Priority changed: LOW → MEDIUM
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences