Summary

A non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.

Impact

A low-privileged user of the platform can install malicious code to obtain higher privileges.

Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid.

Summary An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

Impact An authenticated user with API access can exploit this vulnerability to execute arbitrary SQL queries against the underlying database. This allows unauthorized retrieval of sensitive database contents—including user credentials, system configurations, and personal identifiable information (PII) of contacts—bypassing standard data access permissions.

Patched Versions This security issue has been fixed in the following releases: 7.1.2 6.0.9 5.2.11 4.4.20 ELTS

We strongly recommend upgrading to the latest version corresponding to your release branch.

Workarounds There are no official workarounds. To mitigate this issue without upgrading, you may temporarily disable API access or restrict API permissions to highly trusted accounts.

Summary A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code.

Impact An authenticated user with theme upload and creation privileges can bypass boundaries to execute arbitrary system commands on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

Patched Versions This security issue has been addressed in the following releases: 7.1.2 6.0.9 5.2.11

For users on Mautic 4.x, this fix is available in: 4.4.20 via ELTS

Mautic strongly recommend upgrading to a patched version immediately.

Workarounds There are no official workarounds. To mitigate this vulnerability without upgrading, restrict theme upload and creation permissions (core:themes:create) to only highly trusted administrators.

Summary A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories.

Impact An authenticated user with campaign import privileges (campaign:imports:create) can write arbitrary PHP files to sensitive system directories. An attacker can exploit this to overwrite critical internal configuration or cache components, resulting in Remote Code Execution (RCE) under the context of the web server user.

Patched Versions This security issue has been addressed in the following release: 7.1.2

Note: Mautic 6.x, 5.x, and 4.x branches are not affected by this vulnerability. For general security support regarding legacy Mautic 4 releases, please refer to the ELTS page.

Workarounds There are no official workarounds. To mitigate this risk without upgrading, revoke campaign import permissions (campaign:imports:create) from non-administrative users.

Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can exploit this to inject malicious script payloads.

Impact When an administrative user views an entity associated with a compromised project and hovers over its tag, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, alter system configurations, or exfiltrate sensitive data.

Patched Versions This security issue has been addressed in the following release: 7.1.2

Note: Mautic 6.x, 5.x, and 4.x branches do not contain the Projects feature and are not affected by this vulnerability. For general security support regarding legacy Mautic 4 releases, please refer to the ELTS page.

Workarounds There are no official workarounds. To mitigate this vulnerability without upgrading, restrict project creation and modification permissions to trusted administrative users.

Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project's name.

Impact When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard.

Patched Versions This security issue has been addressed in the following release: 7.1.2

Note: Mautic 6.x, 5.x, and 4.x branches do not contain the Projects feature or the associated AJAX selector and are not affected by this vulnerability. For general security support regarding legacy Mautic 4 releases, please refer to the ELTS page.

Workarounds There are no official workarounds. To mitigate this vulnerability without upgrading, restrict project creation and modification permissions to trusted administrative users.

ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses.

WorkaroundsThe mitigation requires changing the exposephp variable from "On" to "Off" in the file located at /usr/local/etc/php/php.ini.

Mautic before 2.13.0 allows CSV injection.

Impact Mautic before v2.13.0 has stored XSS via a theme config file.

Patches Update to 2.13.0 or later.

Workarounds None.

For more information If you have any questions or comments about this advisory: Email us at security@mautic.org

Mautic uses predictable page indices for unpublished landing pages, their content can be accessed by unauthenticated users under public preview URLs which could expose sensitive data. At the time of publication of the CVE no patch is available

Users with low privileges (all permissions deselected in the administrator permissions settings) can view certain pages that expose sensitive information such as company names, users' names and surnames, stage names, and monitoring campaigns and their descriptions. In addition, unprivileged users can see and edit the descriptions of tags. At the time of publication of the CVE no patch is available.

Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port scan in the back-end. At the time of publication of the CVE no patch is available.

Summary This advisory addresses a SQL Injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.

Mitigation

Please update to 5.2.10, 6.0.8, 7.0.1 or later.

Workarounds

None.

References

If there are any questions or comments about this advisory:

Email Mautic at security@mautic.org

Summary A user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available.

Impact An administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.