Mautic Theme Templates: Server-Side Template Injection to Full Admin Takeover
CVE-2026-9558
Mautic renders uploaded theme templates through Twig without a sandbox. We used that to run system commands, steal the application’s database credentials, …
Exploitability Analysis & Product Security Research
Beyond PoCs.
Real impact.
Every week, advisories label vulnerabilities CRITICAL. Few people verify if they actually are. This blog does.
Latest Research
All posts →9router: When the Signing Key Ships With the Source Code
CVE-2026-49352
A hardcoded fallback JWT signing key, used whenever the operator never sets JWT_SECRET, allows any remote attacker to forge a valid authentication token for …
Apache Tomcat Security Constraints: a real bypass for an uncommon config.
CVE-2026-43515
The bypass is real and reproducible. A POST request to a resource protected by a split web-resource-collection bypasses authentication entirely. But the …
Apache Tomcat DIGEST Auth: The Bypass That Doesn't Bypass
CVE-2026-43512
Even if digest hashes match, authentication still fails. This post documents why CVE-2026-43512 is a confirmed bug but not a confirmed bypass.
What this blog is about
Every week, advisories rate vulnerabilities as CRITICAL. Few people verify whether the impact is actually as severe as it appears. This blog documents that verification process — with real containers, real source code references, and honest verdicts.
Written by a product security engineer. No hype. No speculation. Beyond PoCs. Real impact.
4
CVEs analysed
100%
Source verified
0
Assumptions