This vulnerability (CVE-2026-9558) in Mautic's theme engine involves improper neutralization of special elements used in the Twig template engine (CWE-1336). Authenticated users who can create or upload themes can exploit the lack of sandboxing and function restrictions in template rendering to perform Server-Side Template Injection (SSTI). This enables remote code execution on the hosting server and unauthorized access to sensitive files and configuration settings. The CVSS 3.1 base score is 9.9, reflecting critical impact with network attack vector, low attack complexity, and privileges required. The vulnerability affects specific versions of Mautic (1.3.0, 5.0.0, 6.0.0, and 7.0.0). No official patch or remediation guidance is currently documented.

Successful exploitation allows an authenticated user with theme upload or creation permissions to execute arbitrary code on the server hosting Mautic. This can lead to full system compromise, including unauthorized access to sensitive files and configuration data, and disruption of service. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict theme creation and upload permissions to fully trusted users only. Monitor vendor channels for updates and apply patches promptly once released.