Mautic
by Mautic
Source repositories
CVEs (60)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-9559 | Cri | 0.64 | 9.9 | 0.01 | May 29, 2026 | A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import… | ||
| CVE-2026-9558 | Cri | 0.64 | 9.9 | 0.01 | May 29, 2026 | A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute… | ||
| CVE-2020-35125 | Cri | 0.63 | 9.6 | 0.03 | Feb 9, 2021 | A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[return] (a different attack method than CVE-2020-35124, but also related to the Referer concept). | ||
| CVE-2022-25772 | Cri | 0.60 | 9.6 | 0.61 | Jun 20, 2022 | A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript | ||
| CVE-2025-13828 | Cri | 0.59 | — | 0.00 | Dec 2, 2025 | SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malicious code to obtain… | ||
| CVE-2020-35129 | Cri | 0.59 | 9.0 | 0.01 | Jan 19, 2021 | Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually… | ||
| CVE-2020-35128 | Cri | 0.59 | 9.0 | 0.02 | Jan 19, 2021 | Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions… | ||
| CVE-2025-13827 | Hig | 0.57 | — | 0.00 | Dec 2, 2025 | Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf the media folder is not restricted from running files this can lead to a remote code execution. | ||
| CVE-2018-8092 | Cri | 0.57 | 9.8 | 0.02 | Apr 18, 2018 | Mautic before 2.13.0 allows CSV injection. | ||
| CVE-2017-8874 | Hig | 0.57 | 8.8 | 0.01 | May 10, 2017 | Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) delete email campaigns or (2) delete contacts. | ||
| CVE-2020-35124 | Cri | 0.56 | 9.6 | 0.02 | Jan 28, 2021 | A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of asset downloads. | ||
| CVE-2021-27911 | Hig | 0.54 | 8.3 | 0.01 | Aug 30, 2021 | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can… | ||
| CVE-2024-47051 | Cri | 0.52 | 9.1 | 0.02 | Feb 26, 2025 | This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. * Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified… | ||
| CVE-2026-9809 | Hig | 0.49 | 7.6 | 0.00 | May 29, 2026 | A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization.… | ||
| CVE-2021-27914 | Hig | 0.49 | 7.6 | 0.00 | Jun 1, 2022 | A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript | ||
| CVE-2018-10189 | Hig | 0.49 | 7.5 | 0.01 | Apr 17, 2018 | An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being… | ||
| CVE-2017-1000046 | Hig | 0.49 | 7.5 | 0.01 | Jul 17, 2017 | Mautic 2.6.1 and earlier fails to set flags on session cookies | ||
| CVE-2022-25776 | Hig | 0.47 | 8.3 | 0.00 | Sep 18, 2024 | Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names. | ||
| CVE-2022-25769 | Hig | 0.47 | 7.2 | 0.01 | Sep 18, 2024 | ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path. | ||
| CVE-2026-71245 | Hig | 0.46 | 7.1 | 0.00 | Aug 5, 2026 | Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into… |
- risk 0.64cvss 9.9epss 0.01
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import…
- risk 0.64cvss 9.9epss 0.01
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute…
- risk 0.63cvss 9.6epss 0.03
A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[return] (a different attack method than CVE-2020-35124, but also related to the Referer concept).
- risk 0.60cvss 9.6epss 0.61
A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript
- risk 0.59cvss —epss 0.00
SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malicious code to obtain…
- risk 0.59cvss 9.0epss 0.01
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually…
- risk 0.59cvss 9.0epss 0.02
Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions…
- risk 0.57cvss —epss 0.00
Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf the media folder is not restricted from running files this can lead to a remote code execution.
- risk 0.57cvss 9.8epss 0.02
Mautic before 2.13.0 allows CSV injection.
- risk 0.57cvss 8.8epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) delete email campaigns or (2) delete contacts.
- risk 0.56cvss 9.6epss 0.02
A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of asset downloads.
- risk 0.54cvss 8.3epss 0.01
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can…
- risk 0.52cvss 9.1epss 0.02
This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. * Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified…
- risk 0.49cvss 7.6epss 0.00
A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization.…
- risk 0.49cvss 7.6epss 0.00
A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being…
- risk 0.49cvss 7.5epss 0.01
Mautic 2.6.1 and earlier fails to set flags on session cookies
- risk 0.47cvss 8.3epss 0.00
Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names.
- risk 0.47cvss 7.2epss 0.01
ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.
- risk 0.46cvss 7.1epss 0.00
Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into…
Page 1 of 3