A server‑side template injection flaw in the Twig theme rendering sandbox of Mautic permits an authenticated user with the core:themes:create permission to upload a crafted theme. When the malicious template is rendered, arbitrary code is executed on the server with the web‑server’s privileges, enabling the attacker to run operating‑system commands, read sensitive files including configuration and database credentials, write files, and access internal services. The vulnerability stems from an incomplete enforcement of the sandbox and is classified under CWE‑1336.

All Mautic installations that include the legacy Twig sandbox for theme rendering are affected, especially those where the core:themes:create permission is granted to the Administrator role or delegated to other roles. The flaw exists in all releases prior to the patch that addresses GHSA‑9fx4‑7cmj‑47vg, which corrects the sandbox enforcement. Because the permission is authenticated, any user with the necessary role can trigger the vulnerability.

With a CVSS score of 8.8, the flaw is high severity. The EPSS is not available, but the lack of publicly known exploits and the requirement for authenticated access reduce the likelihood of widespread exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is via a legitimate CMS user uploading a malicious theme; because the template rendering occurs server‑side, the attacker can achieve full remote code execution if the sandbox is breached.