CVE-2026-115189 in Mautic
Summary
by MITRE • 10/26/2026
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified as CVE-2023-5168 represents a critical server-side template injection flaw within the Twig templating engine sandbox of Mautic, specifically targeting the theme rendering subsystem. This issue stems from an incomplete remediation effort related to GHSA-9fx4-7cmj-47vg, where a security sandbox was introduced to restrict user-uploaded theme templates but failed to fully enforce its isolation boundaries. The core technical flaw lies in the template parsing and execution logic, which allows crafted Twig syntax to escape the restricted environment. By exploiting this weakness, an attacker can inject malicious code that is subsequently interpreted by the server-side engine during the rendering process of a theme. This bypasses the intended security controls designed to prevent arbitrary code execution through user-supplied content, effectively neutralizing the protective measures put in place by previous patches.
From an operational perspective, the impact of this vulnerability is severe due to its potential for remote code execution with elevated privileges. An authenticated attacker possessing the core:themes:create permission can upload a malicious theme template that triggers the injection upon rendering. In default configurations, this permission is assigned to the Administrator role, meaning any user with administrative access could inadvertently or intentionally trigger the exploit. However, in multi-operator environments where permissions are delegated, lower-privileged users may also hold sufficient rights to create themes, thereby expanding the attack surface significantly. Once executed, the arbitrary code runs under the context of the web server process, granting the attacker extensive capabilities including executing operating system commands, reading sensitive server-side files such as configuration data and database credentials, writing new files to the filesystem, and potentially accessing internal network services that are otherwise isolated from external access.
This vulnerability aligns with CWE-94, which describes improper control of generation of code or scripts (code injection), specifically manifesting here through template injection mechanisms. The exploitation technique corresponds to ATT&CK T1059, Command and Scripting Interpreter, as the attacker leverages the server-side engine to execute system-level commands. Furthermore, it relates to CWE-78, Improper Neutralization of Special Elements used in an OS Command (OS Command Injection), given that arbitrary operating system commands can be executed directly through the template logic. The persistence aspect is also notable, as uploaded malicious themes may remain on the server until discovered and removed, providing a long-term foothold for further exploitation or data exfiltration.
Mitigation strategies must prioritize immediate patching to the latest version of Mautic that addresses this incomplete fix from GHSA-9fx4-7cmj-47vg. Administrators should audit user roles and permissions to ensure that the core:themes:create permission is restricted only to trusted personnel, particularly in multi-operator setups where delegation might have expanded access unnecessarily. Additionally, implementing strict input validation and output encoding for any theme-related inputs can provide a secondary layer of defense, although reliance on application-level controls alone is insufficient given the server-side nature of this flaw. Regular security audits and penetration testing focused on template injection vectors are recommended to identify similar weaknesses in other parts of the application that may not have received comparable scrutiny during previous remediation efforts.