# mautic/core (Packagist) vulnerabilities

56 known vulnerabilities (5 critical, 15 high, 18 medium, 3 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/mautic/core

## Advisories (56)

### [CVE-2026-9811](https://cve.now/CVE-2026-9811): A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7.

- Severity: Medium 5.4
- Published: May 29, 2026
- Affected: from 7.0.0, fixed in 7.1.2; from 7.0.0, fixed in 7.1.2.

### [CVE-2026-9809](https://cve.now/CVE-2026-9809): A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7.

- Severity: High 7.6
- Published: May 29, 2026
- Affected: from 7.0.0, fixed in 7.1.2; from 7.0.0, fixed in 7.1.2.

### [CVE-2026-9808](https://cve.now/CVE-2026-9808): An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform).

- Severity: High 7.1
- Published: May 29, 2026
- Affected: from 7.0.0, fixed in 7.1.2; from 7.0.0, fixed in 7.1.2.

### [CVE-2026-9559](https://cve.now/CVE-2026-9559): A path traversal vulnerability exists in the campaign import feature of Mautic 7.

- Severity: Critical 9.9
- Published: May 29, 2026
- Affected: from 7.0.0, fixed in 7.1.2; from 7.0.0, fixed in 7.1.2.

### [CVE-2026-9558](https://cve.now/CVE-2026-9558): A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine.

- Severity: Critical 9.9
- Published: May 29, 2026
- Affected: from 1.3.0, fixed in 4.4.20; from 5.0.0, fixed in 5.2.11; from 6.0.0, fixed in 6.0.9; from 7.0.0, fixed in 7.1.2; from 1.3.0; from 5.0.0, fixed in 5.2.11; from 6.0.0, fixed in 6.0.9; from 7.0.0, fixed in 7.1.2.

### [CVE-2026-9557](https://cve.now/CVE-2026-9557): A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component.

- Severity: Medium 6.4
- Published: May 29, 2026
- Affected: from 4.0.0, fixed in 4.4.20; from 5.0.0, fixed in 5.2.11; from 6.0.0, fixed in 6.0.9; from 7.0.0, fixed in 7.1.2; from 4.0.0, through 4.4.13; from 5.0.0, fixed in 5.2.11; from 6.0.0, fixed in 6.0.9; from 7.0.0, fixed in 7.1.2.

### [CVE-2026-4776](https://cve.now/CVE-2026-4776): An SQL injection vulnerability exists in Mautic's API contact filtering mechanism.

- Severity: High 7.1
- Published: May 29, 2026
- Affected: from 2.6.0, fixed in 4.4.20; from 5.0.0, fixed in 5.2.11; from 6.0.0, fixed in 6.0.9; from 7.0.0, fixed in 7.1.2; from 2.6.0, through 4.4.13; from 5.0.0, fixed in 5.2.11; from 6.0.0, fixed in 6.0.9; from 7.0.0, fixed in 7.1.2.

### [CVE-2026-3105](https://cve.now/CVE-2026-3105): SQL Injection in Contact Activity API Sorting

- Severity: High 7.6
- Published: Feb 24, 2026
- Affected: from 2.10.0; from 2.10.0, fixed in 5.2.10; from 6.0.0-alpha, fixed in 6.0.8; from 7.0.0-alpha, fixed in 7.0.1.

### [CVE-2025-13828](https://cve.now/CVE-2025-13828): Mautic user without privileged access to the Marketplace can install and uninstall composer packages

- Severity: Critical 9.0
- Published: Dec 2, 2025
- Affected: fixed in 6.0.7; from 4.0.0, fixed in 4.4.18; from 5.0.0, fixed in 5.2.9; from 6.0.0, fixed in 6.0.7.

### [CVE-2025-9823](https://cve.now/CVE-2025-9823): Reflected XSS in lead:addLeadTags - Quick Add

- Severity: Medium 4.8
- Published: Sep 3, 2025
- Affected: from 4.4.0; from 5.0.0-alpha; from 6.0.0-alpha; from 4.4.0, fixed in 4.4.17; from 5.0.0-alpha, fixed in 5.2.8; from 6.0.0-alpha, fixed in 6.0.5.

### [CVE-2025-9824](https://cve.now/CVE-2025-9824): User Enumeration via Response Timing

- Severity: Medium 5.9
- Published: Sep 3, 2025
- Affected: from 4.4.0; from 5.0.0-alpha; from 6.0.0-alpha; from 4.4.0, fixed in 4.4.17; from 5.0.0-alpha, fixed in 5.2.8; from 6.0.0-alpha, fixed in 6.0.5.

### [CVE-2025-9822](https://cve.now/CVE-2025-9822): Secret data extraction via elfinder

- Severity: Medium 5.5
- Published: Sep 3, 2025
- Affected: from 4.4.0; from 5.0.0-alpha; from 6.0.0-alpha; from 4.4.0, fixed in 4.4.17; from 5.0.0-alpha, fixed in 5.2.8; from 6.0.0-alpha, fixed in 6.0.5.

### [CVE-2025-9821](https://cve.now/CVE-2025-9821): SSRF via webhook function

- Severity: Low 2.7
- Published: Sep 3, 2025
- Affected: from 4.4.0; from 5.0.0-alpha; from 6.0.0-alpha; from 4.4.0, fixed in 4.4.17; from 5.0.0-alpha, fixed in 5.2.8; from 6.0.0-alpha, fixed in 6.0.5.

### [CVE-2025-5256](https://cve.now/CVE-2025-5256): Open Redirect vulnerability on user unlock path

- Severity: Medium 5.4
- Published: May 28, 2025
- Affected: from 1.0.0; from 1.0.0, fixed in 4.4.16; from 5.0.0-alpha, fixed in 5.2.6; from 6.0.0-alpha, fixed in 6.0.2.

### [CVE-2024-47055](https://cve.now/CVE-2024-47055): Segment cloning doesn't have a proper permission check

- Severity: Medium 4.3
- Published: May 28, 2025
- Affected: from 5.0.0; from 5.0.0-alpha, fixed in 5.2.6; from 6.0.0-alpha, fixed in 6.0.2.

### [CVE-2024-47057](https://cve.now/CVE-2024-47057): User name enumeration possible due to response time difference on password reset form

- Severity: Medium 5.3
- Published: May 28, 2025
- Affected: from 1.0; from 1.0.0, fixed in 4.4.16; from 5.0.0-alpha, fixed in 5.2.6; from 6.0.0-alpha, fixed in 6.0.2.

### [CVE-2024-47056](https://cve.now/CVE-2024-47056): Mautic does not shield .env files from web traffic

- Severity: Medium 5.1
- Published: May 28, 2025
- Affected: from 4.4.0; from 4.4.0, fixed in 4.4.16; from 5.0.0-alpha, fixed in 5.2.6; from 6.0.0-alpha, fixed in 6.0.2.

### [CVE-2025-5257](https://cve.now/CVE-2025-5257): Predictable Page Indexing Might Lead to Sensitive Data Exposure

- Severity: Medium 6.5
- Published: May 28, 2025
- Affected: from 4.0; from 4.0.0, fixed in 4.4.16; from 5.0.0-alpha, fixed in 5.2.6; from 6.0.0-alpha, fixed in 6.0.2.

### [CVE-2024-47051](https://cve.now/CVE-2024-47051): Remote Code Execution & File Deletion in Asset Uploads

- Severity: Critical 9.1
- Published: Feb 26, 2025
- Affected: fixed in 5.2.3; fixed in 5.2.3.

### [CVE-2024-47053](https://cve.now/CVE-2024-47053): Improper Authorization in Reporting API

- Severity: High 7.7
- Published: Feb 26, 2025
- Affected: from 1.0.1; from 1.0.1, fixed in 5.2.3.

### [CVE-2022-25773](https://cve.now/CVE-2022-25773): Relative Path Traversal in assets file upload

- Severity: Medium 4.3
- Published: Feb 26, 2025
- Affected: fixed in 5.2.3; fixed in 5.2.3.

### [CVE-2022-25770](https://cve.now/CVE-2022-25770): Insufficient authentication in upgrade flow

- Severity: High 7.8
- Published: Sep 18, 2024
- Affected: from 1.0.0-beta3, fixed in 4.4.13; from 5.0.0-alpha, fixed in 5.1.1.

### [CVE-2024-47059](https://cve.now/CVE-2024-47059): Users enumeration - weak password login

- Severity: Medium 4.3
- Published: Sep 18, 2024
- Affected: from 5.1.0; from 5.1.0, fixed in 5.1.1.

### [CVE-2021-27917](https://cve.now/CVE-2021-27917): XSS in contact tracking and page hits report

- Severity: High 7.3
- Published: Sep 18, 2024
- Affected: from 1.0.0-beta4; from 5.0.0; from 1.0.0-beta4, fixed in 4.4.13; from 5.0.0-alpha, fixed in 5.1.1.

### [CVE-2024-47050](https://cve.now/CVE-2024-47050): XSS in contact/company tracking (no authentication)

- Severity: Medium 5.4
- Published: Sep 18, 2024
- Affected: from 2.6.0; from 5.0.0; from 2.6.0, fixed in 4.4.13; from 5.0.0-alpha, fixed in 5.1.1.

### [CVE-2024-47058](https://cve.now/CVE-2024-47058): Cross-site Scripting (XSS) - stored (edit form HTML field)

- Severity: Low 2.9
- Published: Sep 18, 2024
- Affected: from 1.0.0; from 5.0.0; from 5.0.0-alpha, fixed in 5.1.1; from 1.0.0-beta, fixed in 4.4.13.

### [CVE-2022-25768](https://cve.now/CVE-2022-25768): Improper Access Control in UI upgrade process

- Severity: High 7.0
- Published: Sep 18, 2024
- Affected: from 1.1.3; from 5.0.0; from 1.1.3, fixed in 4.4.13; from 5.0.0-alpha, fixed in 5.1.1.

### [CVE-2022-25777](https://cve.now/CVE-2022-25777): Server-Side Request Forgery in Asset section

- Severity: Medium 6.5
- Published: Sep 18, 2024
- Affected: from 1.0.0-beta4; from 5.0.0; from 1.0.0-beta4, fixed in 4.4.12; from 5.0.0-alpha, fixed in 5.0.4.

### [CVE-2022-25776](https://cve.now/CVE-2022-25776): Sensitive Data Exposure due to inadequate user permission settings

- Severity: High 8.3
- Published: Sep 18, 2024
- Affected: from 1.0.2; from 5.0.0; from 1.0.2, fixed in 4.4.12; from 5.0.0-alpha, fixed in 5.0.4.

### [CVE-2022-25775](https://cve.now/CVE-2022-25775): SQL Injection in dynamic Reports

- Severity: Medium 6.6
- Published: Sep 18, 2024
- Affected: from 2.14.1; from 5.0.0; from 2.14.1, fixed in 4.4.12; from 5.0.0-alpha, fixed in 5.0.4.

### [CVE-2022-25774](https://cve.now/CVE-2022-25774): XSS in Notifications via saving Dashboards

- Severity: Medium 4.8
- Published: Sep 18, 2024
- Affected: fixed in 4.4.12; fixed in 4.4.12.

### [CVE-2022-25769](https://cve.now/CVE-2022-25769): Improper regex in htaccess file

- Severity: High 7.2
- Published: Sep 18, 2024
- Affected: fixed in 3.3.5; fixed in 4.2.0; fixed in 3.3.5; from 4.0.0, fixed in 4.2.0.

### [CVE-2021-27916](https://cve.now/CVE-2021-27916): Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder)

- Severity: High 8.1
- Published: Sep 17, 2024
- Affected: from 3.3.0; from 5.0.0; from 3.3.0, fixed in 4.4.12; from 5.0.0-alpha, fixed in 5.0.4.

### [CVE-2021-27915](https://cve.now/CVE-2021-27915): XSS Cross-site Scripting Stored (XSS) - Description field

- Severity: High 7.6
- Published: Sep 17, 2024
- Affected: from 1.0.0-beta2, fixed in 4.4.12.

### [CVE-2022-25772](https://cve.now/CVE-2022-25772): A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject…

- Severity: Critical 9.6
- Published: Jun 20, 2022
- Affected: fixed in 4.3.0.

### [CVE-2021-27909](https://cve.now/CVE-2021-27909): XSS vulnerability on password reset page

- Severity: Medium 6.3
- Published: Aug 30, 2021
- Affected: fixed in 3.3.4; from 4.0.0-alpha1, fixed in 4.0.0.

### [CVE-2021-27913](https://cve.now/CVE-2021-27913): Use of a Broken or Risky Cryptographic Algorithm

- Severity: Low 3.5
- Published: Aug 30, 2021
- Affected: fixed in 3.3.4; from 4.0.0-alpha1, fixed in 4.0.0.

### [CVE-2021-27912](https://cve.now/CVE-2021-27912): XSS vulnerability on asset view

- Severity: High 7.1
- Published: Aug 30, 2021
- Affected: fixed in 3.3.4; from 4.0.0-alpha1, fixed in 4.0.0.

### [CVE-2021-27911](https://cve.now/CVE-2021-27911): XSS vulnerability on contacts view

- Severity: High 8.3
- Published: Aug 30, 2021
- Affected: fixed in 3.3.4; from 4.0.0-alpha1, fixed in 4.0.0.

### [CVE-2021-27910](https://cve.now/CVE-2021-27910): Stored XSS vulnerability on Bounce Management Callback

- Severity: High 8.2
- Published: Aug 30, 2021
- Affected: fixed in 3.3.4; from 4.0.0-alpha1, fixed in 4.0.0.

### [CVE-2021-27908](https://cve.now/CVE-2021-27908): In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin…

- Severity: Medium 5.8
- Published: Mar 23, 2021
- Affected: fixed in 3.3.2.

### [CVE-2020-35125](https://cve.now/CVE-2020-35125): A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable…

- Severity: Unrated
- Published: Feb 9, 2021
- Affected: fixed in 2.16.5; from 3.0.0, fixed in 3.2.4.

### [CVE-2020-35124](https://cve.now/CVE-2020-35124): A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable…

- Severity: Unrated
- Published: Jan 28, 2021
- Affected: from 3.0.0, fixed in 3.2.4; from 2.0.0, fixed in 2.16.5.

### [CVE-2020-35128](https://cve.now/CVE-2020-35128): Mautic before 3.2.4 is affected by stored XSS.

- Severity: Unrated
- Published: Jan 19, 2021
- Affected: from 3.2.0, fixed in 3.2.4; from 2.0.0, fixed in 2.16.5.

### [CVE-2020-35129](https://cve.now/CVE-2020-35129): Mautic before 3.2.4 is affected by stored XSS.

- Severity: Unrated
- Published: Jan 19, 2021
- Affected: fixed in 3.2.4.

### [CVE-2018-11200](https://cve.now/CVE-2018-11200): An issue was discovered in Mautic 2.13.1.

- Severity: Unrated
- Published: Sep 20, 2019
- Affected: fixed in 2.14.0.

### [CVE-2018-11198](https://cve.now/CVE-2018-11198): An issue was discovered in Mautic 2.13.1.

- Severity: Unrated
- Published: Sep 6, 2019
- Affected: from 2.13.1, fixed in 2.14.0.

### [CVE-2018-8092](https://cve.now/CVE-2018-8092): Mautic before 2.13.0 allows CSV injection.

- Severity: Unrated
- Published: Apr 18, 2018
- Affected: fixed in 2.13.0.

### [CVE-2018-8071](https://cve.now/CVE-2018-8071): Mautic before v2.13.0 has stored XSS via a theme config file.

- Severity: Unrated
- Published: Apr 18, 2018
- Affected: fixed in 2.13.0.

### [CVE-2018-10189](https://cve.now/CVE-2018-10189): An issue was discovered in Mautic 1.x and 2.x before 2.13.0.

- Severity: Unrated
- Published: Apr 17, 2018
- Affected: fixed in 2.13.0.

### [CVE-2017-1000506](https://cve.now/CVE-2017-1000506): Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of…

- Severity: Unrated
- Published: Feb 9, 2018
- Affected: fixed in 2.14.2.

### [CVE-2017-1000490](https://cve.now/CVE-2017-1000490): Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the…

- Severity: Unrated
- Published: Jan 3, 2018
- Affected: from 1.0.0, fixed in 2.12.0.

### [CVE-2017-1000489](https://cve.now/CVE-2017-1000489): Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address

- Severity: Unrated
- Published: Jan 3, 2018
- Affected: from 2.0.0, fixed in 2.12.0.

### [CVE-2017-1000488](https://cve.now/CVE-2017-1000488): Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET…

- Severity: Unrated
- Published: Jan 3, 2018
- Affected: from 2.1.0, fixed in 2.12.0.

### [CVE-2017-1000046](https://cve.now/CVE-2017-1000046): Mautic 2.6.1 and earlier fails to set flags on session cookies

- Severity: Unrated
- Published: Jul 13, 2017
- Affected: fixed in 2.1.1.

### [CVE-2017-8874](https://cve.now/CVE-2017-8874): Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users…

- Severity: Unrated
- Published: May 10, 2017
- Affected: versions 1.4.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/mautic/core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.