Exploit for CVE-2026-9558

cve · 2026-05-29

Description

CVE-2026-9558: SSTI in Mautic theme engine enables code execution or file access via uploaded Twig templates.

All known vulnerabilities by product

Mautic

CVSS 9.9 for CVE-2026-9558

9.9

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

0.6%higher than 44.8% of all CVEs

Updated 2026-08-27

CVE Information

CVE-2026-9558

References

https://github.com/mautic/mautic/security/advisories/GHSA-9fx4-7cmj-47vg

Exploit Details

Modified:2026-07-21 12:10

Last Seen:2026-07-21 12:31

Reporter:Mautic

Other exploits for CVE-2026-9558

cve-2026-9558-poc

2026-08-25 KitPloitKITPLOIT

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=CVE-2026-9558
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

Exploit Code

Share

Share on social media: