A Server‑Side Template Injection flaw in the Mautic theme engine allows users who can create or upload themes to supply arbitrary Twig templates that the platform renders without a sandbox. This unrestrained rendering permits an attacker to execute arbitrary code on the hosting server and to read files and configuration settings beyond the intended access scope. The weakness is classified as CWE‑1336 and carries a CVSS score of 9.9, indicating a high‑severity risk.

The vulnerability affects the Mautic platform’s theme engine. Specific product or version information is not provided, so all installations of Mautic that deploy the theme engine and allow theme uploads remain potentially vulnerable. Users should verify whether their system permits theme creation or upload by administrators or other privileged users.

An authenticated user with theme‑upload permissions can trigger the flaw. The lack of a sandbox means the attacker can leverage the Twig engine to run server‑side code, achieving remote code execution or data exfiltration. No exploit probability (EPSS) is available, but the high CVSS score and absence from KEV suggest that it is not yet widely exploited yet remains a serious threat. The attack vector is inferred to be internal, relying on user privileges rather than an external network attack.