Is CVE-2026-115189 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115189 being exploited in the wild.

How severe is CVE-2026-115189?

High severity, with a CVSS score of 8.8, published 26 October 2026.

Which products and versions are affected?

Mautic Core 1.3.0 to 5.2.11, 6.0.0 to 6.0.9, 7.0.0 to 7.2.1.

How is CVE-2026-115189 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115189?

Check whether you run Mautic Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115189: Mautic Twig sandbox escape in theme templates

CVE-2026-115189 · Severity: high · CVSS 8.8 · Published 2026-10-26

Mautic, a marketing automation platform, allows authenticated administrators to upload custom theme templates. An incomplete sandbox that was meant to restrict what these templates can do does not fully prevent escape, enabling an attacker with theme creation permissions to execute arbitrary code on the server. This gives the attacker the ability to read sensitive files like database credentials, modify files, and run commands on the underlying system.

Technologies: Mautic Core. Vendors: Mautic.

Quick answers

Is CVE-2026-115189 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115189 being exploited in the wild.
How severe is CVE-2026-115189?: High severity, with a CVSS score of 8.8, published 26 October 2026.
Which products and versions are affected?: Mautic Core 1.3.0 to 5.2.11, 6.0.0 to 6.0.9, 7.0.0 to 7.2.1.
Is there a fix for CVE-2026-115189?: Yes: fixed in 5.2.12, 6.0.10, 7.2.2 (Mautic 4.4 through ELTS). Until then: Restrict the core:themes:create permission to trusted administrator accounts only and do not delegate theme creation permissions to operator-level roles. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115189 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115189?: Check whether you run Mautic Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.2.12, 6.0.10, 7.2.2 (Mautic 4.4 through ELTS)

Restrict the core:themes:create permission to trusted administrator accounts only and do not delegate theme creation permissions to operator-level roles.

Technical details

A server-side template injection vulnerability exists in Mautic's Twig theme rendering sandbox. The vulnerability is an incomplete fix for GHSA-9fx4-7cmj-47vg and allows a crafted theme template to escape sandbox restrictions, enabling arbitrary code execution. An authenticated user with core:themes:create permission can upload a malicious theme template that executes with the privileges of the web server process.

Affected products

Mautic Core 1.3.0 to 5.2.11, 6.0.0 to 6.0.9, 7.0.0 to 7.2.1

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.