Mautic: Twig sandbox escape via theme templates

Summary

Overview

Mautic renders theme templates through Twig with a sandbox that limits what template code can do. The sandbox could be escaped from a theme template.

An escape removes the limits the sandbox is meant to enforce on template code. The advisory rates the issue High at CVSS 8.8.

The issue is fixed in Mautic 7.2.2, 6.0.10, and 5.2.12. The GitHub advisory and the CVE were published on October 26, 2026. Mautic is its own CNA.

Sequence

Attack path

1. 01

   Step 1

   Create or edit a theme template in Mautic.

2. 02

   Step 2

   The template escapes the Twig sandbox that is meant to limit it.

3. 03

   Step 3

   Template code then runs without the sandbox limits.

4. 04

   Step 4

   Impact is bounded by what the escaped template can reach in the Mautic process.

#poc

Proof of concept

On affected releases, a theme template could escape the Twig sandbox. The same template on 7.2.2, 6.0.10, and 5.2.12 does not.

We will update this post at a later time to include additional proof of concept details. Operators should treat theme template editing on affected releases as in scope and upgrade.

#exploit

Exploitation

The primitive is escape from the Twig sandbox in theme templates. Reaching it requires the ability to create or edit a theme template.

What an escaped template can reach depends on the Mautic process and its permissions.

We will update this post at a later time to include additional exploitation details.

#details

Technical details

Root cause: theme templates could escape the Twig sandbox that is meant to limit template code.

Affected configuration: Mautic releases before the 7.2.2, 6.0.10, and 5.2.12 fixes.

The fix in 7.2.2, 6.0.10, and 5.2.12 restores the sandbox limits for theme templates.

Remediation

Fixed in Mautic 7.2.2, 6.0.10, and 5.2.12.

• Upgrade to Mautic 7.2.2, 6.0.10, or 5.2.12 or later on your release line.
• Until you can upgrade, limit theme template editing to people you already trust with template code.

How Submersion found it

1. 01

   Step 1

   We will update this post at a later time to include proof of concept and exploitation details.

Basin was pointed at Mautic. It received the application and a running environment. It did not receive a vulnerability description, an exploit, a patch diff, or a prior disclosure.

Mautic is its own CNA.

Disclosure

Disclosure timeline

1. 2026-10-26

   Published

   Published as CVE-2026-115189

References

• CVE-2026-115189
• GitHub advisory GHSA-h7pm-79gc-8867