This vulnerability arises from Mautic's theme engine rendering user-uploaded Twig templates without sandboxing or function restrictions, enabling Server-Side Template Injection (SSTI). Authenticated users with permissions to create or upload themes can exploit this to execute arbitrary code remotely on the server or access sensitive system files and configurations. The vulnerability affects multiple Mautic versions (1.3.0, 5.0.0, 6.0.0, 7.0.0) and has a CVSS 3.1 score of 9.9, reflecting critical severity with network attack vector and low complexity. No official fix or patch is currently documented, and no public exploits are known.

Successful exploitation allows an authenticated user with theme upload or creation permissions to perform remote code execution on the hosting server and access restricted system files and configuration settings. This can lead to full system compromise, data exposure, and service disruption. The vulnerability has a critical CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict theme creation and upload permissions to trusted users only. Monitor for updates from Mautic regarding patches or mitigations. Avoid uploading untrusted templates and consider isolating Mautic instances to limit potential impact.