CVE-2026-115189

Name of the Vulnerable Software and Affected Versions Mautic (affected versions not specified)

Description A server-side template injection occurs in the Twig theme rendering sandbox. The sandbox, designed to restrict user-uploaded theme templates, fails to fully enforce restrictions, allowing a crafted template to escape. An authenticated user with the core:themes:create permission can upload a malicious theme that, when rendered, enables arbitrary code execution with the privileges of the web server process. This allows for the execution of operating system commands, reading of server-side files such as configuration files and database credentials, writing files, and accessing internal services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.