CVE-2026-9558
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.9epss 0.6%
from disclosure to weapon42 days
Published on NVDMay 29
1st PoC+42d
exploitation probability
0.6%top 56% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
mautic/corepublic PoCs found — 1
githubgithub.com/covepseng/cve-2026-9558-poc★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.