Mautic EUVD-2026-109793

The attacker must be able to store a crafted serialized value in Mautic's segment filter or custom field properties, which per the advisory requires high privileges (PR:H) - administrative permissions to manage segments and custom fields, API write access to those objects, or direct write access to the Mautic database. The injected payload only fires when Mautic subsequently processes the stored data: during segment evaluation, contact export, or custom field API requests. Full remote code execution additionally depends on a usable gadget chain being present in Mautic's dependencies; without a suitable chain the impact may be limited to object instantiation side effects. The primary limiting factors are the high-privilege/write prerequisite and the gadget-chain dependency; no end-user interaction is required (UI:N).

Severity is High (CVSS 8.0, CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), but the real-world priority is tempered by the access gate. The vector is network-reachable (AV:N) and scope-changing (S:C, consistent with code execution escaping the application to the host OS), yet exploitation requires high privileges (PR:H) - an account able to write to segment-filter or custom-field properties, or direct database write access - and the advisory itself notes full code execution is 'combined with gadget chains available in Mautic's dependencies', which aligns with the AC:H rating. There is no CISA KEV entry, so this is 'no public exploit identified at time of analysis'; no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. The only reference is the vendor GHSA advisory, not a working exploit. The vuln.today decision label is 'this_week', indicating prompt patching rather than an emergency. Net: a genuine high-impact RCE/data-compromise issue, but one gated behind privileged access and a usable gadget chain, so it is best treated as a this-week remediation priority rather than an internet-facing drive-by, and most dangerous as a privilege-escalation / insider or post-compromise vector.

A high-privileged Mautic user, a compromised admin/API account with rights to manage segments or custom fields, or any party with write access to the Mautic database stores a crafted serialized value in a segment filter or custom field property. When Mautic later processes that data (segment evaluation, contact export, or a custom field API request), the unrestricted deserialization instantiates arbitrary PHP objects whose magic methods run automatically, and combined with a dependency gadget chain this can execute arbitrary code on the server. No public exploit was identified at time of analysis.