security@mautic.org
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS security@mautic.org
03
assessed vulnerabilities (53)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-115196US | — | — | ||
An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return… | ||||
| CVE-2026-115195US | —OT elevated | — | ||
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended adminis… | ||||
| CVE-2026-115194US | — | — | ||
A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory.… | ||||
| CVE-2026-115193US | — | — | ||
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization.… | ||||
| CVE-2026-115192US | — | — | ||
An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before… | ||||
| CVE-2026-115191US | — | — | ||
A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to searc… | ||||
| CVE-2026-115190US | — | — | ||
An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stor… | ||||
| CVE-2026-115189US | — | — | ||
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for G… | ||||
| CVE-2026-115188US | — | — | ||
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset… | ||||
| CVE-2026-9811US | — | Exploit | ||
A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities… | ||||
| CVE-2026-9809US | — | Exploit | ||
A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as ca… | ||||
| CVE-2026-9808US | —OT elevated | — | ||
An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (su… | ||||
| CVE-2026-9559US | — | — | ||
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows… | ||||
| CVE-2026-9558US | — | Exploit | ||
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restriction… | ||||
| CVE-2026-9557US | — | — | ||
A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbo… | ||||
| CVE-2026-4776US | — | — | ||
An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user… | ||||
| CVE-2026-3105US | high8.8 | — | ||
SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Co… | ||||
| CVE-2025-13828US | —OT elevated | — | ||
SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based up… | ||||
| CVE-2025-13827US | — | — | ||
Summary
Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted.
ImpactIf the media folder is not restricted from r… | ||||
| CVE-2025-9824US | — | — | ||
ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could… | ||||