Skip to content
OpenAdvisories

Package · Packagist

mautic/core

57 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-9559

    Mautic vulnerable to Path Traversal via Campaign Import

    A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user …

    mautic/core Packagist
  • Critical 9.9
    CVE-2026-9558 Public exploit

    Mautic has Server-Side Template Injection (SSTI) in Theme Templates

    A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse th…

    mautic/core Packagist
  • Critical 9.0
    CVE-2025-13828

    Mautic user without privileged access to the Marketplace can install and uninstall composer packages

    SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malic…

    Mautic Mautic mautic/core Packagist
  • Critical 9.1
    CVE-2024-47051 Public exploit

    Remote Code Execution & File Deletion in Asset Uploads

    This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. * Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has b…

    Mautic mautic/core mautic/core Packagist
  • Critical 9.6
    CVE-2022-25772 EPSS 63%

    Cross-site Scripting vulnerability in Mautic's tracking pixel functionality

    A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript

    Mautic Mautic mautic/core Packagist
  • Critical 9.6
    CVE-2020-35125

    Mautic is vulnerable to XSS vulnerability

    A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[return] (a different attack method than CVE-2020-35124, but also related to the Referer concept).

    mautic/core Packagist
  • Critical —
    CVE-2020-35124

    XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic

    A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of asset downloads.

    mautic/core Packagist
  • Critical 9.0
    CVE-2020-35128

    Mautic stored Cross-site Scripting (XSS)

    Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventu…

    mautic/core Packagist
  • Critical 9.0
    CVE-2020-35129

    Mautic stored Cross-site Scripting (XSS)

    Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow…

    mautic/core Packagist
  • Critical 9.8
    CVE-2018-8092

    CSV Injection vulnerability with exported contact lists in Mautic

    Mautic before 2.13.0 allows CSV injection.

    mautic/core Packagist