Mautic: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 9

• Critical 9.9
  CVE-2026-115188

  An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploade…

  Oct 26, 2026
• High 8.8
  CVE-2026-115189

  A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introd…

  Oct 26, 2026
• High 8.2
  CVE-2026-115193

  A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type cu…

  Oct 26, 2026
• High 8.0
  CVE-2026-115190

  An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and cus…

  Oct 26, 2026
• High 7.1
  CVE-2026-115191

  A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax)…

  Oct 26, 2026
• High 7.1
  CVE-2026-115192

  An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parame…

  Oct 26, 2026
• Medium 6.5
  CVE-2026-115194

  A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplie…

  Oct 26, 2026
• Medium 6.5
  CVE-2026-115195

  A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce…

  Oct 26, 2026
• Medium 5.4
  CVE-2026-115196

  An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is …

  Oct 26, 2026

Revision history

1. 2026-10-26 #2

   Referenz(en) aufgenommen: EUVD-2026-109800, EUVD-2026-109799, EUVD-2026-109798, EUVD-2026-109797, EUVD-2026-109796, EUVD-2026-109794, EUVD-2026-109793, EUVD-2026-109792, EUVD-2026-109791

2. 2026-10-25 #1

   Initiale Fassung

References

• GitHub Security Advisory GHSA-3295-vq3p-93rw vom 2026-10-25
  https://github.com/mautic/mautic/security/advisories/GHSA-3295-vq3p-93rw
• GitHub Security Advisory GHSA-5mm3-3g7p-9868 vom 2026-10-25
  https://github.com/mautic/mautic/security/advisories/GHSA-5mm3-3g7p-9868
• GitHub Security Advisory GHSA-5r63-8h35-j3mw vom 2026-10-25
  https://github.com/mautic/mautic/security/advisories/GHSA-5r63-8h35-j3mw
• GitHub Security Advisory GHSA-7j28-9rg4-wg63 vom 2026-10-25
  https://github.com/mautic/mautic/security/advisories/GHSA-7j28-9rg4-wg63
• GitHub Security Advisory GHSA-fj8v-c9c3-7q26 vom 2026-10-25
  https://github.com/mautic/mautic/security/advisories/GHSA-fj8v-c9c3-7q26
• GitHub Security Advisory GHSA-h7pm-79gc-8867 vom 2026-10-25
  https://github.com/mautic/mautic/security/advisories/GHSA-h7pm-79gc-8867
• GitHub Security Advisory GHSA-mxjf-pghx-h299 vom 2026-10-25
  https://github.com/mautic/mautic/security/advisories/GHSA-mxjf-pghx-h299
• GitHub Security Advisory GHSA-qpmx-7pq3-5q2v vom 2026-10-25
  https://github.com/mautic/mautic/security/advisories/GHSA-qpmx-7pq3-5q2v
• GitHub Security Advisory GHSA-wfhm-289v-79vp vom 2026-10-25
  https://github.com/mautic/mautic/security/advisories/GHSA-wfhm-289v-79vp