CVE-2026-9558: Critical Twig SSTI in Mautic Theme Templates Enables RCE

What's the vulnerability

CVE-2026-9558 is a critical Server-Side Template Injection (SSTI) flaw in Mautic's theme template engine, tracked under CWE-1336 (Twig-based SSTI). Mautic uses Twig to render themes, emails, and landing pages. Because theme customization, the email/landing page builder, and theme upload/import functionality accept attacker-influenced input that reaches the Twig rendering pipeline without adequate sandboxing, an attacker can inject malicious Twig syntax. Twig template injection is not a sandboxed scripting risk — successful exploitation typically allows arbitrary PHP code execution on the underlying host, giving the attacker full control of the application server.

Depending on deployment configuration, exploitation may require authentication or, in some cases, may be reachable unauthenticated — raising the practical risk significantly for internet-facing Mautic instances.

Affected software

The vulnerability affects mautic/core across a wide range of release branches:

• >= 1.3.0, < 4.4.13
• >= 5.0.0, < 5.2.11
• >= 6.0.0, < 6.0.9
• >= 7.0.0, < 7.1.2

This spans nearly every actively deployed major version line, meaning most production Mautic installations are potentially exposed until upgraded to a fixed release.

Exploitation status

A public proof-of-concept and advisory (GHSA-9fx4-7cmj-47vg) are available, placing this in PoC-public status. It is not yet confirmed in CISA's KEV catalog or observed as weaponized in the wild based on current data, but public PoC availability significantly shortens the window before opportunistic exploitation begins. Given the CVSS 9.9 severity and the breadth of affected versions, defenders should treat this as an urgent patching and detection priority rather than a theoretical concern.

How our detection catches it

We ship detection logic for CVE-2026-9558 across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL). At a high level, the detection logic focuses on:

• Identifying requests to Mautic theme customization, email/landing page builder, and theme upload/import endpoints that contain Twig template control syntax (e.g., delimiter patterns and function/filter calls indicative of injection attempts) rather than expected template content.
• Correlating suspicious web requests to these endpoints with subsequent anomalous PHP process execution, outbound connections, or file writes originating from the Mautic web server process — consistent with successful RCE following SSTI.
• Flagging theme import/upload activity carrying embedded Twig expressions outside of normal theme package structure.

This layered approach lets defenders catch both the injection attempt at the web layer and the downstream execution behavior if initial prevention fails.

Recommended action

Upgrade affected Mautic instances to the patched release for your branch as soon as possible, and deploy the detection content above to identify exploitation attempts in the interim. Full detection logic, including the KQL, SPL, and other SIEM queries, is available on the CVE-2026-9558 detection page.