A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.2.12, 6.0.10, 7.2.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Mautic, an open-source marketing automation platform, is affected through its Twig theme rendering feature. An authenticated user with permission to create themes can upload a crafted theme that escapes the intended restrictions and runs arbitrary code on the server, letting them run system commands, read or write server files (including configuration and database credentials), and reach internal services.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- mautic/core
From 1.3.0 · fixed in 5.2.12; From 6.0.0 · fixed in 6.0.10; From 7.0.0 · fixed in 7.2.2