DeutschShown in its original language — a full translation is planned for a future version.
Mautic: Mehrere Schwachstellen
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Mautic ausnutzen, um SQL-Injection- und Server-Side Request Forgery (SSRF)-Angriffe durchzuführen und um Informationen offenzulegen, beliebigen JavaScript-Code im Browser anderer Benutzer auszuführen, Dateien außerhalb vorgesehener Verzeichnisse einzubinden oder zu manipulieren sowie unter Umständen beliebigen Code auf dem Server auszuführen.
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-9811US | — | Exploit | ||
A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities… | ||||
| CVE-2026-9809US | — | Exploit | ||
A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as ca… | ||||
| CVE-2026-9808US | —OT elevated | — | ||
An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (su… | ||||
| CVE-2026-9559US | — | — | ||
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows… | ||||
| CVE-2026-9558US | — | Exploit | ||
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restriction… | ||||
| CVE-2026-9557US | — | — | ||
A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbo… | ||||
| CVE-2026-4776US | — | — | ||
An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user… | ||||
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-2jrw-c95w-h43g vom 2026-05-29external
- GitHub Security Advisory GHSA-5hvg-w58j-545m vom 2026-05-29external
- GitHub Security Advisory GHSA-6r9h-4h75-7q4x vom 2026-05-29external
- GitHub Security Advisory GHSA-7h65-whp7-rgqf vom 2026-05-29external
- GitHub Security Advisory GHSA-9fx4-7cmj-47vg vom 2026-05-29external
- GitHub Security Advisory GHSA-fcmw-wx57-9p75 vom 2026-05-28external
- GitHub Security Advisory GHSA-jmv8-8j9j-rcpc vom 2026-05-28external
- WID-SEC-W-2026-1724 - CSAF Versionself
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan