Mautic
Monthly
Stored cross-site scripting in Mautic 7.0.0 through 7.2.1 allows anyone who can write a value into an HTML-type custom contact field - through contact editing, the contact API, or a form submission mapped to that field - to plant script that executes in a victim's browser session when the affected contact's detail page is opened, potentially letting the attacker create administrator accounts, change system configuration, or read contact and campaign data. The independent assessment records the write path as authenticated (PR:L), with an unauthenticated route existing only where a public form is deliberately mapped to an HTML field, whereas the vendor scored the same issue PR:N; exploitation additionally requires a configured HTML-type field and a second, more-privileged user opening the record (UI:R). No public exploit code or PoC was identified in the available intelligence, and no active exploitation is indicated; Mautic 7.2.2 is the only complete fix, with 4.x, 5.x and 6.x confirmed unaffected.
Blind SQL injection in the Mautic dashboard widget data API (/api/data/{type}) allows an authenticated account holding API access to read arbitrary contents of the Mautic database, including contact and marketing records and user accounts with password hashes. Exploitation requires two conditions to hold simultaneously: the Mautic API must be enabled on the instance, and the attacker must hold a valid account with API access (CVSS PR:L); no unauthenticated path exists, and instances with the API disabled or restricted to trusted users are not exploitable. Integrity impact is none - data modification is not possible - while availability impact is limited to attacker-induced query slowdowns; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released fixed versions 7.2.2, 6.0.10 and 5.2.12.
Authenticated SQL injection in Mautic's contact lookup AJAX endpoint (/s/ajax) allows any valid user account, regardless of role or assigned permissions, to run blind boolean-based or time-based queries against the Mautic database and read data the database user can access, including user email addresses and password hashes, contact records, and campaign and email content. The flaw affects Mautic releases from 2.1.0 before 5.2.12, 6.0.x before 6.0.10, and 7.0.x before 7.2.2; anonymous access is not sufficient because a valid account is required. No public exploit code has been identified at time of analysis, and the priority signal is this_week rather than an emergency.
PHP object injection in Mautic's segment filters and custom field properties can escalate to server-side code execution because stored serialized values are deserialized without class restrictions and Mautic's dependencies may supply usable gadget chains. The flaw affects Mautic core versions before 5.2.12, 6.0.10 and 7.2.0; exploitation requires high privileges or an existing ability to write the affected stored data, and the payload fires when Mautic later evaluates segments, exports contacts or serves custom field API requests. No public exploit was identified at the time of analysis, and the vendor advisory lists fixed releases for each maintained branch.
Server-side template injection in Mautic's Twig theme sandbox lets an authenticated user holding the core:themes:create permission upload a crafted theme that escapes sandbox restrictions and executes arbitrary code as the web server process. The flaw is an incomplete fix for GHSA-9fx4-7cmj-47vg and affects Mautic core branches before 5.2.12, 6.0.10, and 7.2.2. It is a high-priority issue, though exploitation requires privileged theme-creation access; no public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data.
Remote code execution can result in Mautic 7 (7.0.0 through 7.2.1) when campaign-import archives carry asset files that are copied into the public media directory without filename or type validation. An authenticated user holding campaign-import create permission, without administrator rights, can upload server-side scripts through the UI or the /api/campaigns/import endpoint, but code execution depends on the web server honoring per-directory configuration and executing scripts from media/, as the official Apache Docker image does. The vendor fixed the issue in 7.2.2, and no public exploit is identified at time of analysis; CISA KEV status is not indicated.
Mautic's Contact Activity API endpoint is vulnerable to SQL injection due to insufficient validation of the sort direction parameter, allowing authenticated attackers to execute arbitrary SQL queries. This high-severity vulnerability (CVSS 7.6) affects multiple versions and could enable unauthorized data access or modification. No patch is currently available; users should contact security@mautic.org for mitigation guidance.
Open redirect in Mautic's public form submission endpoint (/form/submit) causes the application to send a visitor to a return address supplied with the submission without confirming that it resolves to the Mautic instance or another trusted host, so a crafted form can bounce visitors from a legitimate Mautic domain to an attacker-chosen external site such as a phishing clone or a malware delivery page. Every Mautic release below 5.2.12, 6.0.10 and 7.2.2 is affected, and any instance with a published public form is exposed; the attacker needs no authentication (PR:N) but the victim must actually submit the attacker-prepared form (UI:R), which keeps this a moderate-priority, social-engineering-dependent issue rather than an emergency. No public exploit code was identified at time of analysis, and the vendor rates the impact as limited confidentiality and integrity only (CVSS 5.4).
Path traversal in Mautic's Asset API lets an authenticated API user with asset-creation permission register a file outside the asset upload directory and publish it so its public download URL exposes arbitrary files readable by the web server, including Mautic configuration secrets. The affected composer/mautic/core branches are fixed in 7.2.2, 6.0.10, and 5.2.12; no public exploit was identified at the time of analysis.
SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Mautic before 2.13.0 allows CSV injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Mautic before v2.13.0 has stored XSS via a theme config file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Mautic 1.x and 2.x before 2.13.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Mautic 2.6.1 and earlier fails to set flags on session cookies. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) delete email campaigns or (2) delete. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in Mautic 7.0.0 through 7.2.1 allows anyone who can write a value into an HTML-type custom contact field - through contact editing, the contact API, or a form submission mapped to that field - to plant script that executes in a victim's browser session when the affected contact's detail page is opened, potentially letting the attacker create administrator accounts, change system configuration, or read contact and campaign data. The independent assessment records the write path as authenticated (PR:L), with an unauthenticated route existing only where a public form is deliberately mapped to an HTML field, whereas the vendor scored the same issue PR:N; exploitation additionally requires a configured HTML-type field and a second, more-privileged user opening the record (UI:R). No public exploit code or PoC was identified in the available intelligence, and no active exploitation is indicated; Mautic 7.2.2 is the only complete fix, with 4.x, 5.x and 6.x confirmed unaffected.
Blind SQL injection in the Mautic dashboard widget data API (/api/data/{type}) allows an authenticated account holding API access to read arbitrary contents of the Mautic database, including contact and marketing records and user accounts with password hashes. Exploitation requires two conditions to hold simultaneously: the Mautic API must be enabled on the instance, and the attacker must hold a valid account with API access (CVSS PR:L); no unauthenticated path exists, and instances with the API disabled or restricted to trusted users are not exploitable. Integrity impact is none - data modification is not possible - while availability impact is limited to attacker-induced query slowdowns; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released fixed versions 7.2.2, 6.0.10 and 5.2.12.
Authenticated SQL injection in Mautic's contact lookup AJAX endpoint (/s/ajax) allows any valid user account, regardless of role or assigned permissions, to run blind boolean-based or time-based queries against the Mautic database and read data the database user can access, including user email addresses and password hashes, contact records, and campaign and email content. The flaw affects Mautic releases from 2.1.0 before 5.2.12, 6.0.x before 6.0.10, and 7.0.x before 7.2.2; anonymous access is not sufficient because a valid account is required. No public exploit code has been identified at time of analysis, and the priority signal is this_week rather than an emergency.
PHP object injection in Mautic's segment filters and custom field properties can escalate to server-side code execution because stored serialized values are deserialized without class restrictions and Mautic's dependencies may supply usable gadget chains. The flaw affects Mautic core versions before 5.2.12, 6.0.10 and 7.2.0; exploitation requires high privileges or an existing ability to write the affected stored data, and the payload fires when Mautic later evaluates segments, exports contacts or serves custom field API requests. No public exploit was identified at the time of analysis, and the vendor advisory lists fixed releases for each maintained branch.
Server-side template injection in Mautic's Twig theme sandbox lets an authenticated user holding the core:themes:create permission upload a crafted theme that escapes sandbox restrictions and executes arbitrary code as the web server process. The flaw is an incomplete fix for GHSA-9fx4-7cmj-47vg and affects Mautic core branches before 5.2.12, 6.0.10, and 7.2.2. It is a high-priority issue, though exploitation requires privileged theme-creation access; no public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data.
Remote code execution can result in Mautic 7 (7.0.0 through 7.2.1) when campaign-import archives carry asset files that are copied into the public media directory without filename or type validation. An authenticated user holding campaign-import create permission, without administrator rights, can upload server-side scripts through the UI or the /api/campaigns/import endpoint, but code execution depends on the web server honoring per-directory configuration and executing scripts from media/, as the official Apache Docker image does. The vendor fixed the issue in 7.2.2, and no public exploit is identified at time of analysis; CISA KEV status is not indicated.
Mautic's Contact Activity API endpoint is vulnerable to SQL injection due to insufficient validation of the sort direction parameter, allowing authenticated attackers to execute arbitrary SQL queries. This high-severity vulnerability (CVSS 7.6) affects multiple versions and could enable unauthorized data access or modification. No patch is currently available; users should contact security@mautic.org for mitigation guidance.
Open redirect in Mautic's public form submission endpoint (/form/submit) causes the application to send a visitor to a return address supplied with the submission without confirming that it resolves to the Mautic instance or another trusted host, so a crafted form can bounce visitors from a legitimate Mautic domain to an attacker-chosen external site such as a phishing clone or a malware delivery page. Every Mautic release below 5.2.12, 6.0.10 and 7.2.2 is affected, and any instance with a published public form is exposed; the attacker needs no authentication (PR:N) but the victim must actually submit the attacker-prepared form (UI:R), which keeps this a moderate-priority, social-engineering-dependent issue rather than an emergency. No public exploit code was identified at time of analysis, and the vendor rates the impact as limited confidentiality and integrity only (CVSS 5.4).
Path traversal in Mautic's Asset API lets an authenticated API user with asset-creation permission register a file outside the asset upload directory and publish it so its public download URL exposes arbitrary files readable by the web server, including Mautic configuration secrets. The affected composer/mautic/core branches are fixed in 7.2.2, 6.0.10, and 5.2.12; no public exploit was identified at the time of analysis.
SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Mautic before 2.13.0 allows CSV injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Mautic before v2.13.0 has stored XSS via a theme config file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Mautic 1.x and 2.x before 2.13.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Mautic 2.6.1 and earlier fails to set flags on session cookies. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) delete email campaigns or (2) delete. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.