Description
A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | mautic/core | 4.0.0 – < 4.4.20, 5.0.0 – < 5.2.11, 6.0.0 – < 6.0.9, 7.0.0 – < 7.1.2 | 4.4.20 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | mautic/core | >= 4.0.0, <= 4.4.13 | — | GHSA-jmv8-8j9j-rcpc |
| Packagist | mautic/core | >= 5.0.0, < 5.2.11 | 5.2.11 | GHSA-jmv8-8j9j-rcpc |
| Packagist | mautic/core | >= 6.0.0, < 6.0.9 | 6.0.9 | GHSA-jmv8-8j9j-rcpc |
| Packagist | mautic/core | >= 7.0.0, < 7.1.2 | 7.1.2 | GHSA-jmv8-8j9j-rcpc |
Advisories 1
- WID-SEC-2026-1724 Mautic: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 31, 2026