DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Mautic: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-10-25
Ein Angreifer kann mehrere Schwachstellen in Mautic ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (9)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-115196US | — | — | ||
An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return… | ||||
| CVE-2026-115195US | —OT erhöht | — | ||
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended adminis… | ||||
| CVE-2026-115194US | — | — | ||
A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory.… | ||||
| CVE-2026-115193US | — | — | ||
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization.… | ||||
| CVE-2026-115192US | — | — | ||
An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before… | ||||
| CVE-2026-115191US | — | — | ||
A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to searc… | ||||
| CVE-2026-115190US | — | — | ||
An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stor… | ||||
| CVE-2026-115189US | — | — | ||
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for G… | ||||
| CVE-2026-115188US | — | — | ||
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- GitHub Security Advisory GHSA-3295-vq3p-93rw vom 2026-10-25external
- GitHub Security Advisory GHSA-5mm3-3g7p-9868 vom 2026-10-25external
- GitHub Security Advisory GHSA-5r63-8h35-j3mw vom 2026-10-25external
- GitHub Security Advisory GHSA-7j28-9rg4-wg63 vom 2026-10-25external
- GitHub Security Advisory GHSA-fj8v-c9c3-7q26 vom 2026-10-25external
- GitHub Security Advisory GHSA-h7pm-79gc-8867 vom 2026-10-25external
- GitHub Security Advisory GHSA-mxjf-pghx-h299 vom 2026-10-25external
- GitHub Security Advisory GHSA-qpmx-7pq3-5q2v vom 2026-10-25external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan