PackagistPackage

mautic/core

56 known vulnerabilities (5 critical, 15 high, 18 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 56 · 5 critical, 15 high, 18 medium, 3 low

Registry: Packagist

Advisories 56

CVE-2026-9811Medium 5.4
A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7.
Affected: from 7.0.0, fixed in 7.1.2; from 7.0.0, fixed in 7.1.2.
CVE-2026-9809High 7.6
A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7.
Affected: from 7.0.0, fixed in 7.1.2; from 7.0.0, fixed in 7.1.2.
CVE-2026-9808High 7.1
An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform).
Affected: from 7.0.0, fixed in 7.1.2; from 7.0.0, fixed in 7.1.2.
CVE-2026-9559Critical 9.9
A path traversal vulnerability exists in the campaign import feature of Mautic 7.
Affected: from 7.0.0, fixed in 7.1.2; from 7.0.0, fixed in 7.1.2.
CVE-2026-9558Critical 9.9
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine.
Affected: from 1.3.0, fixed in 4.4.20; from 5.0.0, fixed in 5.2.11; from 6.0.0, fixed in 6.0.9; from 7.0.0, fixed in 7.1.2; from 1.3.0; from 5.0.0, fixed in 5.2.11; from 6.0.0, fixed in 6.0.9; from 7.0.0, fixed in 7.1.2.
CVE-2026-9557Medium 6.4
A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component.
Affected: from 4.0.0, fixed in 4.4.20; from 5.0.0, fixed in 5.2.11; from 6.0.0, fixed in 6.0.9; from 7.0.0, fixed in 7.1.2; from 4.0.0, through 4.4.13; from 5.0.0, fixed in 5.2.11; from 6.0.0, fixed in 6.0.9; from 7.0.0, fixed in 7.1.2.
CVE-2026-4776High 7.1
An SQL injection vulnerability exists in Mautic's API contact filtering mechanism.
Affected: from 2.6.0, fixed in 4.4.20; from 5.0.0, fixed in 5.2.11; from 6.0.0, fixed in 6.0.9; from 7.0.0, fixed in 7.1.2; from 2.6.0, through 4.4.13; from 5.0.0, fixed in 5.2.11; from 6.0.0, fixed in 6.0.9; from 7.0.0, fixed in 7.1.2.
CVE-2026-3105High 7.6
SQL Injection in Contact Activity API Sorting
Affected: from 2.10.0; from 2.10.0, fixed in 5.2.10; from 6.0.0-alpha, fixed in 6.0.8; from 7.0.0-alpha, fixed in 7.0.1.
CVE-2025-13828Critical 9.0
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
Affected: fixed in 6.0.7; from 4.0.0, fixed in 4.4.18; from 5.0.0, fixed in 5.2.9; from 6.0.0, fixed in 6.0.7.
CVE-2025-9823Medium 4.8
Reflected XSS in lead:addLeadTags - Quick Add
Affected: from 4.4.0; from 5.0.0-alpha; from 6.0.0-alpha; from 4.4.0, fixed in 4.4.17; from 5.0.0-alpha, fixed in 5.2.8; from 6.0.0-alpha, fixed in 6.0.5.
CVE-2025-9824Medium 5.9
User Enumeration via Response Timing
Affected: from 4.4.0; from 5.0.0-alpha; from 6.0.0-alpha; from 4.4.0, fixed in 4.4.17; from 5.0.0-alpha, fixed in 5.2.8; from 6.0.0-alpha, fixed in 6.0.5.
CVE-2025-9822Medium 5.5
Secret data extraction via elfinder
Affected: from 4.4.0; from 5.0.0-alpha; from 6.0.0-alpha; from 4.4.0, fixed in 4.4.17; from 5.0.0-alpha, fixed in 5.2.8; from 6.0.0-alpha, fixed in 6.0.5.
CVE-2025-9821Low 2.7
SSRF via webhook function
Affected: from 4.4.0; from 5.0.0-alpha; from 6.0.0-alpha; from 4.4.0, fixed in 4.4.17; from 5.0.0-alpha, fixed in 5.2.8; from 6.0.0-alpha, fixed in 6.0.5.
CVE-2025-5256Medium 5.4
Open Redirect vulnerability on user unlock path
Affected: from 1.0.0; from 1.0.0, fixed in 4.4.16; from 5.0.0-alpha, fixed in 5.2.6; from 6.0.0-alpha, fixed in 6.0.2.
CVE-2024-47055Medium 4.3
Segment cloning doesn't have a proper permission check
Affected: from 5.0.0; from 5.0.0-alpha, fixed in 5.2.6; from 6.0.0-alpha, fixed in 6.0.2.

Show all 56 advisoriesShow fewer advisories

CVE-2024-47057Medium 5.3
User name enumeration possible due to response time difference on password reset form
Affected: from 1.0; from 1.0.0, fixed in 4.4.16; from 5.0.0-alpha, fixed in 5.2.6; from 6.0.0-alpha, fixed in 6.0.2.
CVE-2024-47056Medium 5.1
Mautic does not shield .env files from web traffic
Affected: from 4.4.0; from 4.4.0, fixed in 4.4.16; from 5.0.0-alpha, fixed in 5.2.6; from 6.0.0-alpha, fixed in 6.0.2.
CVE-2025-5257Medium 6.5
Predictable Page Indexing Might Lead to Sensitive Data Exposure
Affected: from 4.0; from 4.0.0, fixed in 4.4.16; from 5.0.0-alpha, fixed in 5.2.6; from 6.0.0-alpha, fixed in 6.0.2.
CVE-2024-47051Critical 9.1
Remote Code Execution & File Deletion in Asset Uploads
Affected: fixed in 5.2.3; fixed in 5.2.3.
CVE-2024-47053High 7.7
Improper Authorization in Reporting API
Affected: from 1.0.1; from 1.0.1, fixed in 5.2.3.
CVE-2022-25773Medium 4.3
Relative Path Traversal in assets file upload
Affected: fixed in 5.2.3; fixed in 5.2.3.
CVE-2022-25770High 7.8
Insufficient authentication in upgrade flow
Affected: from 1.0.0-beta3, fixed in 4.4.13; from 5.0.0-alpha, fixed in 5.1.1.
CVE-2024-47059Medium 4.3
Users enumeration - weak password login
Affected: from 5.1.0; from 5.1.0, fixed in 5.1.1.
CVE-2021-27917High 7.3
XSS in contact tracking and page hits report
Affected: from 1.0.0-beta4; from 5.0.0; from 1.0.0-beta4, fixed in 4.4.13; from 5.0.0-alpha, fixed in 5.1.1.
CVE-2024-47050Medium 5.4
XSS in contact/company tracking (no authentication)
Affected: from 2.6.0; from 5.0.0; from 2.6.0, fixed in 4.4.13; from 5.0.0-alpha, fixed in 5.1.1.
CVE-2024-47058Low 2.9
Cross-site Scripting (XSS) - stored (edit form HTML field)
Affected: from 1.0.0; from 5.0.0; from 5.0.0-alpha, fixed in 5.1.1; from 1.0.0-beta, fixed in 4.4.13.
CVE-2022-25768High 7.0
Improper Access Control in UI upgrade process
Affected: from 1.1.3; from 5.0.0; from 1.1.3, fixed in 4.4.13; from 5.0.0-alpha, fixed in 5.1.1.
CVE-2022-25777Medium 6.5
Server-Side Request Forgery in Asset section
Affected: from 1.0.0-beta4; from 5.0.0; from 1.0.0-beta4, fixed in 4.4.12; from 5.0.0-alpha, fixed in 5.0.4.
CVE-2022-25776High 8.3
Sensitive Data Exposure due to inadequate user permission settings
Affected: from 1.0.2; from 5.0.0; from 1.0.2, fixed in 4.4.12; from 5.0.0-alpha, fixed in 5.0.4.
CVE-2022-25775Medium 6.6
SQL Injection in dynamic Reports
Affected: from 2.14.1; from 5.0.0; from 2.14.1, fixed in 4.4.12; from 5.0.0-alpha, fixed in 5.0.4.
CVE-2022-25774Medium 4.8
XSS in Notifications via saving Dashboards
Affected: fixed in 4.4.12; fixed in 4.4.12.
CVE-2022-25769High 7.2
Improper regex in htaccess file
Affected: fixed in 3.3.5; fixed in 4.2.0; fixed in 3.3.5; from 4.0.0, fixed in 4.2.0.
CVE-2021-27916High 8.1
Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder)
Affected: from 3.3.0; from 5.0.0; from 3.3.0, fixed in 4.4.12; from 5.0.0-alpha, fixed in 5.0.4.
CVE-2021-27915High 7.6
XSS Cross-site Scripting Stored (XSS) - Description field
Affected: from 1.0.0-beta2, fixed in 4.4.12.
CVE-2022-25772Critical 9.6
A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject…
Affected: fixed in 4.3.0.
CVE-2021-27909Medium 6.3
XSS vulnerability on password reset page
Affected: fixed in 3.3.4; from 4.0.0-alpha1, fixed in 4.0.0.
CVE-2021-27913Low 3.5
Use of a Broken or Risky Cryptographic Algorithm
Affected: fixed in 3.3.4; from 4.0.0-alpha1, fixed in 4.0.0.
CVE-2021-27912High 7.1
XSS vulnerability on asset view
Affected: fixed in 3.3.4; from 4.0.0-alpha1, fixed in 4.0.0.
CVE-2021-27911High 8.3
XSS vulnerability on contacts view
Affected: fixed in 3.3.4; from 4.0.0-alpha1, fixed in 4.0.0.
CVE-2021-27910High 8.2
Stored XSS vulnerability on Bounce Management Callback
Affected: fixed in 3.3.4; from 4.0.0-alpha1, fixed in 4.0.0.
CVE-2021-27908Medium 5.8
In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin…
Affected: fixed in 3.3.2.
CVE-2020-35125Unrated
A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable…
Affected: fixed in 2.16.5; from 3.0.0, fixed in 3.2.4.
CVE-2020-35124Unrated
A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable…
Affected: from 3.0.0, fixed in 3.2.4; from 2.0.0, fixed in 2.16.5.
CVE-2020-35128Unrated
Mautic before 3.2.4 is affected by stored XSS.
Affected: from 3.2.0, fixed in 3.2.4; from 2.0.0, fixed in 2.16.5.
CVE-2020-35129Unrated
Mautic before 3.2.4 is affected by stored XSS.
Affected: fixed in 3.2.4.
CVE-2018-11200Unrated
An issue was discovered in Mautic 2.13.1.
Affected: fixed in 2.14.0.
CVE-2018-11198Unrated
An issue was discovered in Mautic 2.13.1.
Affected: from 2.13.1, fixed in 2.14.0.
CVE-2018-8092Unrated
Mautic before 2.13.0 allows CSV injection.
Affected: fixed in 2.13.0.
CVE-2018-8071Unrated
Mautic before v2.13.0 has stored XSS via a theme config file.
Affected: fixed in 2.13.0.
CVE-2018-10189Unrated
An issue was discovered in Mautic 1.x and 2.x before 2.13.0.
Affected: fixed in 2.13.0.
CVE-2017-1000506Unrated
Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of…
Affected: fixed in 2.14.2.
CVE-2017-1000490Unrated
Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the…
Affected: from 1.0.0, fixed in 2.12.0.
CVE-2017-1000489Unrated
Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address
Affected: from 2.0.0, fixed in 2.12.0.
CVE-2017-1000488Unrated
Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET…
Affected: from 2.1.0, fixed in 2.12.0.
CVE-2017-1000046Unrated
Mautic 2.6.1 and earlier fails to set flags on session cookies
Affected: fixed in 2.1.1.
CVE-2017-8874Unrated
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users…
Affected: versions 1.4.1.