CVE-2026-9558 CRITICAL

CVE-2026-9558

Weakness CWE-1336

Published May 29, 2026

Last update May 29, 2026

View on NVD All CVEs

CVSS base score

9.9/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

Key dates

02Disclosure timeline

May 29, 2026 CVE published

May 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-9558 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1336.html

Related vulnerabilities

04Related CVE

CVE-2024-25624 iris-web vulnerable to Server Side Template Injection in reports CVE-2026-34587 Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering CVE-2026-41065 Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory CVE-2026-21450 Bagisto has SSTI in parameter that can lead to RCE CVE-2025-68929 Frappe may be vulnerable remote code execution due to server-side template injection