# CVE-2026-115189: Mautic Twig sandbox escape in theme templates

Source: https://junglewise.ai/threats/cve-2026-115189-a-server-side-template-injection-vulnerability-exists-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-115189 · Severity: high · CVSS 8.8 · Published 2026-10-26

Mautic, a marketing automation platform, allows authenticated administrators to upload custom theme templates. An incomplete sandbox that was meant to restrict what these templates can do does not fully prevent escape, enabling an attacker with theme creation permissions to execute arbitrary code on the server. This gives the attacker the ability to read sensitive files like database credentials, modify files, and run commands on the underlying system.

Technologies: [Mautic Core](https://junglewise.ai/threats/technologies/mautic-core). Vendors: [Mautic](https://junglewise.ai/threats/vendors/mautic).

## Quick answers

**Is CVE-2026-115189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115189 being exploited in the wild.

**How severe is CVE-2026-115189?** High severity, with a CVSS score of 8.8, published 26 October 2026.

**Which products and versions are affected?** Mautic Core 1.3.0 to 5.2.11, 6.0.0 to 6.0.9, 7.0.0 to 7.2.1.

**Is there a fix for CVE-2026-115189?** Yes: fixed in 5.2.12, 6.0.10, 7.2.2 (Mautic 4.4 through ELTS). Until then: Restrict the core:themes:create permission to trusted administrator accounts only and do not delegate theme creation permissions to operator-level roles. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115189 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-115189?** Check whether you run Mautic Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.2.12, 6.0.10, 7.2.2 (Mautic 4.4 through ELTS)

Restrict the core:themes:create permission to trusted administrator accounts only and do not delegate theme creation permissions to operator-level roles.

## Technical details

A server-side template injection vulnerability exists in Mautic's Twig theme rendering sandbox. The vulnerability is an incomplete fix for GHSA-9fx4-7cmj-47vg and allows a crafted theme template to escape sandbox restrictions, enabling arbitrary code execution. An authenticated user with core:themes:create permission can upload a malicious theme template that executes with the privileges of the web server process.

## Affected products

- Mautic Core 1.3.0 to 5.2.11, 6.0.0 to 6.0.9, 7.0.0 to 7.2.1

## Timeline

- 2026-10-26: disclosed

## References

- [https://packagist.org/](https://packagist.org/)
- [https://github.com/mautic/mautic/security/advisories/GHSA-h7pm-79gc-8867](https://github.com/mautic/mautic/security/advisories/GHSA-h7pm-79gc-8867)

## Related threats

- [Mautic Asset API path traversal vulnerability](https://junglewise.ai/threats/cve-2026-115194-a-path-traversal-vulnerability-exists-in-the-mautic-asset-api)
- [Mautic stored XSS in Projects component project tags](https://junglewise.ai/threats/cve-2026-9809-mautic-stored-xss-in-projects-component-project-tags)
- [Mautic Core authorization bypass in API v2 endpoints](https://junglewise.ai/threats/cve-2026-9808-mautic-core-authorization-bypass-in-api-v2-endpoints)
- [Mautic path traversal in campaign import feature](https://junglewise.ai/threats/cve-2026-9559-mautic-path-traversal-in-campaign-import-feature)