Mautic vulnerabilities
40 CVEs and advisories name Mautic as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-3105SQL Injection in Contact Activity API Sorting
- CVE-2025-13828Mautic user without privileged access to the Marketplace can install and uninstall composer packages
- CVE-2025-13827GrapesJsBuilder File Upload allows all file uploads
- CVE-2025-9823Reflected XSS in lead:addLeadTags - Quick Add
- CVE-2025-9824User Enumeration via Response Timing
- CVE-2025-9822Secret data extraction via elfinder
- CVE-2025-9821SSRF via webhook function
- CVE-2025-7381Exposure of sensitive PHP information to an unauthorized control sphere in mautic/mautic images
- CVE-2025-5256Open Redirect vulnerability on user unlock path
- CVE-2024-47055Segment cloning doesn't have a proper permission check
- CVE-2024-47057User name enumeration possible due to response time difference on password reset form
- CVE-2024-47056Mautic does not shield .env files from web traffic
- CVE-2025-5257Predictable Page Indexing Might Lead to Sensitive Data Exposure
- CVE-2024-47051Remote Code Execution & File Deletion in Asset Uploads
- CVE-2024-47053Improper Authorization in Reporting API
- CVE-2022-25773Relative Path Traversal in assets file upload
- CVE-2022-25770Insufficient authentication in upgrade flow
- CVE-2024-47059Users enumeration - weak password login
- CVE-2021-27917XSS in contact tracking and page hits report
- CVE-2024-47050XSS in contact/company tracking (no authentication)
- CVE-2024-47058Cross-site Scripting (XSS) - stored (edit form HTML field)
- CVE-2022-25768Improper Access Control in UI upgrade process
- CVE-2022-25777Server-Side Request Forgery in Asset section
- CVE-2022-25776Sensitive Data Exposure due to inadequate user permission settings
- CVE-2022-25775SQL Injection in dynamic Reports
- CVE-2022-25774XSS in Notifications via saving Dashboards
- CVE-2022-25769Improper regex in htaccess file
- CVE-2021-27916Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder)
- CVE-2021-27915XSS Cross-site Scripting Stored (XSS) - Description field
- CVE-2024-3448Improper Access Control Leads to Server-Side Request Forgery in Mautic