Security Advisories - mautic/core

mautic/core Security Advisories for 5.0.0-alpha (26)

[CRITICAL] Mautic has Server-Side Template Injection (SSTI) in Theme Templates

PKSA-5wpq-7gbm-cqxv CVE-2026-9558 GHSA-9fx4-7cmj-47vg

Affected version: >=7.0.0,<7.1.2|>=6.0.0,<6.0.9|>=5.0.0,<5.2.11|>=1.3.0,<4.4.13

Reported by:
GitHub
[MEDIUM] Mautic Focus component Vulnerable to SSRF

PKSA-tmx3-5zmv-624c CVE-2026-9557 GHSA-jmv8-8j9j-rcpc

Affected version: >=7.0.0,<7.1.2|>=6.0.0,<6.0.9|>=5.0.0,<5.2.11|>=4.0.0,<=4.4.13

Reported by:
GitHub
[HIGH] Mautic has SQL Injection in API Contact Filtering

PKSA-pdn1-217f-vc3y CVE-2026-4776 GHSA-fcmw-wx57-9p75

Affected version: >=7.0.0,<7.1.2|>=6.0.0,<6.0.9|>=5.0.0,<5.2.11|>=2.6.0,<=4.4.13

Reported by:
GitHub
[HIGH] Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting

PKSA-frhs-vjy5-hffg CVE-2026-3105 GHSA-r5j5-q42h-fc93

Affected version: >=7.0.0-alpha,<7.0.1|>=6.0.0-alpha,<6.0.8|>=2.10.0,<5.2.10

Reported by:
GitHub
[CRITICAL] Mautic user without privileged access to the Marketplace can install and uninstall composer packages

PKSA-j693-8gvk-sx7v CVE-2025-13828 GHSA-3fq7-c5m8-g86x

Affected version: >=6.0.0,<6.0.7|>=5.0.0,<5.2.9|>=4.0.0,<4.4.18

Reported by:
GitHub
[MEDIUM] Mautic Vulnerable to User Enumeration via Response Timing

PKSA-f1xn-2dhr-qrdb CVE-2025-9824 GHSA-3ggv-qwcp-j6xg

Affected version: >=6.0.0-alpha,<6.0.5|>=5.0.0-alpha,<5.2.8|>=4.4.0,<4.4.17

Reported by:
GitHub
[MEDIUM] Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add

PKSA-vhyd-4d5p-sjmg CVE-2025-9823 GHSA-9v8p-m85m-f7mm

Affected version: >=6.0.0-alpha,<6.0.5|>=5.0.0-alpha,<5.2.8|>=4.4.0,<4.4.17

Reported by:
GitHub
[MEDIUM] Mautic vulnerable to secret data extraction via elfinder

PKSA-bn7t-4gr8-g6ns CVE-2025-9822 GHSA-438m-6mhw-hq5w

Affected version: >=6.0.0-alpha,<6.0.5|>=5.0.0-alpha,<5.2.8|>=4.4.0,<4.4.17

Reported by:
GitHub
[LOW] Mautic vulnerable to SSRF via webhook function

PKSA-1vkq-hh1n-xfrh CVE-2025-9821 GHSA-hj6f-7hp7-xg69

Affected version: >=6.0.0-alpha,<6.0.5|>=5.0.0-alpha,<5.2.8|>=4.4.0,<4.4.17

Reported by:
GitHub
[MEDIUM] Mautic has an Open Redirect vulnerability on user unlock path.

PKSA-q26v-9dpb-k2fj CVE-2025-5256 GHSA-6vx9-9r2g-8373

Affected version: >=6.0.0-alpha,<6.0.2|>=5.0.0-alpha,<5.2.6|>=1.0.0,<4.4.16

Reported by:
GitHub
[MEDIUM] Mautic segment cloning doesn't have a proper permission check

PKSA-t9vw-npky-6xmt CVE-2024-47055 GHSA-vph5-ghq3-q782

Affected version: >=6.0.0-alpha,<6.0.2|>=5.0.0-alpha,<5.2.6

Reported by:
GitHub
[MEDIUM] Mautic allows user name enumeration due to response time difference on password reset form

PKSA-s7ys-knkq-xqw6 CVE-2024-47057 GHSA-424x-cxvh-wq9p

Affected version: >=6.0.0-alpha,<6.0.2|>=5.0.0-alpha,<5.2.6|>=1.0.0,<4.4.16

Reported by:
GitHub
[MEDIUM] Mautic does not shield .env files from web traffic

PKSA-x5tz-t44g-gk96 CVE-2024-47056 GHSA-h2wg-v8wg-jhxh

Affected version: >=6.0.0-alpha,<6.0.2|>=5.0.0-alpha,<5.2.6|>=4.4.0,<4.4.16

Reported by:
GitHub
[MEDIUM] Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure

PKSA-x59g-t3yz-wmhz CVE-2025-5257 GHSA-cqx4-9vqf-q3m8

Affected version: >=6.0.0-alpha,<6.0.2|>=5.0.0-alpha,<5.2.6|>=4.0.0,<4.4.16

Reported by:
GitHub
[MEDIUM] Mautic allows Relative Path Traversal in assets file upload

PKSA-r9y9-cx91-ppbj CVE-2022-25773 GHSA-4w2w-36vm-c8hf

Affected version: <5.2.3

Reported by:
GitHub
[HIGH] Mautic allows Improper Authorization in Reporting API

PKSA-d6g7-gn2x-xxxs CVE-2024-47053 GHSA-8xv7-g2q3-fqgc

Affected version: >=1.0.1,<5.2.3

Reported by:
GitHub
[CRITICAL] Mautic allows Remote Code Execution and File Deletion in Asset Uploads

PKSA-r8cy-ghyg-685v CVE-2024-47051 GHSA-73gx-x7r9-77x2

Affected version: <5.2.3

Reported by:
GitHub
[MEDIUM] Mautic has insufficient authentication in upgrade flow

PKSA-zrpx-tjt4-ctvz CVE-2022-25770 GHSA-qf6m-6m4g-rmrc

Affected version: >=5.0.0-alpha,<5.1.1|>=1.0.0-beta3,<4.4.13

Reported by:
GitHub
[MEDIUM] Mautic has an XSS in contact tracking and page hits report

PKSA-39c1-mjv2-cwmh CVE-2021-27917 GHSA-xpc5-rr39-v8v2

Affected version: >=5.0.0-alpha,<5.1.1|>=1.0.0-beta4,<4.4.13

Reported by:
GitHub
[MEDIUM] Mautic vulnerable to XSS in contact/company tracking (no authentication)

PKSA-x4f7-yvw2-qxkj CVE-2024-47050 GHSA-73gr-32wg-qhh7

Affected version: >=5.0.0-alpha,<5.1.1|>=2.6.0,<4.4.13

Reported by:
GitHub
[MEDIUM] Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field)

PKSA-zw3g-4t7k-356g CVE-2024-47058 GHSA-xv68-rrmw-9xwf

Affected version: >=1.0.0-beta,<4.4.13|>=5.0.0-alpha,<5.1.1

Reported by:
GitHub
[HIGH] Mautic vulnerable to Improper Access Control in UI upgrade process

PKSA-1qjd-2pbn-b37d CVE-2022-25768 GHSA-x3jx-5w6m-q2fc

Affected version: >=5.0.0-alpha,<5.1.1|>=1.1.3,<4.4.13

Reported by:
GitHub
[MEDIUM] Mautic: MST-48 Server-Side Request Forgery in Asset section

PKSA-qbyg-mfvh-bykw CVE-2022-25777 GHSA-mgv8-w49f-822w

Affected version: >=5.0.0-alpha,<5.0.4|>=1.0.0-beta4,<4.4.12

Reported by:
GitHub
[HIGH] Mautic Sensitive Data Exposure due to inadequate user permission settings

PKSA-h1nj-n1bm-2hgs CVE-2022-25776 GHSA-qjx3-2g35-6hv8

Affected version: >=5.0.0-alpha,<5.0.4|>=1.0.2,<4.4.12

Reported by:
GitHub
[MEDIUM] Mautic SQL Injection in dynamic Reports

PKSA-sy5k-g715-pnjy CVE-2022-25775 GHSA-jj6w-2cqg-7p94

Affected version: >=5.0.0-alpha,<5.0.4|>=2.14.1,<4.4.12

Reported by:
GitHub
[HIGH] Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder

PKSA-xg8c-5dhf-6tcn CVE-2021-27916 GHSA-9fcx-cv56-w58p

Affected version: >=5.0.0-alpha,<5.0.4|>=3.3.0,<4.4.12

Reported by:
GitHub

mautic/core Security Advisories for 5.0.0-alpha (26)

[CRITICAL] Mautic has Server-Side Template Injection (SSTI) in Theme Templates

[MEDIUM] Mautic Focus component Vulnerable to SSRF

[HIGH] Mautic has SQL Injection in API Contact Filtering

[HIGH] Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting

[CRITICAL] Mautic user without privileged access to the Marketplace can install and uninstall composer packages

[MEDIUM] Mautic Vulnerable to User Enumeration via Response Timing

[MEDIUM] Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add

[MEDIUM] Mautic vulnerable to secret data extraction via elfinder

[LOW] Mautic vulnerable to SSRF via webhook function

[MEDIUM] Mautic has an Open Redirect vulnerability on user unlock path.

[MEDIUM] Mautic segment cloning doesn't have a proper permission check

[MEDIUM] Mautic allows user name enumeration due to response time difference on password reset form

[MEDIUM] Mautic does not shield .env files from web traffic

[MEDIUM] Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure

[MEDIUM] Mautic allows Relative Path Traversal in assets file upload

[HIGH] Mautic allows Improper Authorization in Reporting API

[CRITICAL] Mautic allows Remote Code Execution and File Deletion in Asset Uploads

[MEDIUM] Mautic has insufficient authentication in upgrade flow

[MEDIUM] Mautic has an XSS in contact tracking and page hits report

[MEDIUM] Mautic vulnerable to XSS in contact/company tracking (no authentication)

[MEDIUM] Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field)

[HIGH] Mautic vulnerable to Improper Access Control in UI upgrade process

[MEDIUM] Mautic: MST-48 Server-Side Request Forgery in Asset section

[HIGH] Mautic Sensitive Data Exposure due to inadequate user permission settings

[MEDIUM] Mautic SQL Injection in dynamic Reports

[HIGH] Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder