Description
SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.
ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mautic | Mautic | <4.4.18, <5.2.9, <6.0.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | mautic/core | >= 4.0.0, < 4.4.18 | 4.4.18 | GHSA-3fq7-c5m8-g86x |
| Packagist | mautic/core | >= 5.0.0, < 5.2.9 | 5.2.9 | GHSA-3fq7-c5m8-g86x |
| Packagist | mautic/core | >= 6.0.0, < 6.0.7 | 6.0.7 | GHSA-3fq7-c5m8-g86x |
Advisories 1
- WID-SEC-2025-2721 Mautic: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 2, 2025