Skip to content
OpenAdvisories
High WID-SEC-2026-1724 7 CVEs

Mautic: Mehrere Schwachstellen

Published May 28, 2026 · Updated May 31, 2026 · Revision 2 · de-DE

Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Mautic ausnutzen, um SQL-Injection- und Server-Side Request Forgery (SSRF)-Angriffe durchzuführen und um Informationen offenzulegen, beliebigen JavaScript-Code im Browser anderer Benutzer auszuführen, Dateien außerhalb vorgesehener Verzeichnisse einzubinden oder zu manipulieren sowie unter Umständen beliebigen Code auf dem Server auszuführen.

Product

Mautic ist eine Open-Source-Marketing-Automatisierungsplattform, die Unternehmen bei der Verwaltung von Marketingkampagnen und der Kundenbeziehungspflege unterstützt.

Vulnerabilities 7

  • Critical 9.9
    CVE-2026-9558 Public exploit

    Mautic has Server-Side Template Injection (SSTI) in Theme Templates

    A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse th…

    mautic/core Packagist
  • Critical 9.9
    CVE-2026-9559

    Mautic vulnerable to Path Traversal via Campaign Import

    A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user …

    mautic/core Packagist
  • High 7.6
    CVE-2026-9809 Public exploit

    Mautic has Stored Cross-Site Scripting (XSS) in Projects Component

    A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without pr…

    mautic/core Packagist
  • High 7.1
    CVE-2026-4776

    Mautic has SQL Injection in API Contact Filtering

    An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

    mautic/core Packagist
  • High 7.1
    CVE-2026-9808

    Mautic has an Authorization Bypass in API v2 Endpoints

    An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as `viewown` or `editown`) are not properly enforced. This allows low-privil…

    mautic/core Packagist
  • Medium 6.4
    CVE-2026-9557

    Mautic Focus component Vulnerable to SSRF

    A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaiss…

    mautic/core Packagist
  • Medium 5.4
    CVE-2026-9811 Public exploit

    Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector

    A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before inje…

    mautic/core Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-33276, EUVD-2026-33273, EUVD-2026-33280, EUVD-2026-33279, EUVD-2026-33278, EUVD-2026-33277

  2. #1

    Initiale Fassung

References