An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker.
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.
A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API user with permission to create assets can register any file that is readable by the web server process as a Mautic asset. When the asset is published, its public download URL serves the contents of that file without authentication. This allows the attacker to read arbitrary files from the server, including Mautic configuration files containing the database password, secret key, and mail (SMTP) credentials, as well as system files and any other file readable by the web server user. Exposed credentials can be used to access the database or other connected services, and anyone with the public asset URL can retrieve the file contents.
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.
An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled.
A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this, regardless of the role or permissions assigned to the account. Using blind (boolean-based or time-based) techniques, the attacker can run arbitrary SQL queries against the Mautic database and read any data the Mautic database user can access, including Mautic user accounts with email addresses and password hashes, contact data, and campaign and email content.
An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of using Mautic's safe deserialization helper. An attacker who is able to store a crafted serialized value in these segment filter or custom field properties can cause arbitrary PHP objects to be instantiated when Mautic later processes the data, for example during segment evaluation, contact export, or custom field API requests. Combined with gadget chains available in Mautic's dependencies, this could allow an attacker to execute arbitrary code on the server, read, modify, or delete data stored in the Mautic instance, including contact data, and affect its availability. Exploitation requires high privileges or an existing ability to write to the affected stored data.
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg.
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.
CVE-2026-9811 is a stored Cross-Site Scripting (XSS) vulnerability in Mautic version 7.0.0. It occurs in the project selector component where project names returned via AJAX are not properly sanitized before being injected into the DOM. An authenticated user with project creation permissions can store malicious scripts in project names, which execute when another administrative user opens an entity editor containing the project selector. This can lead to session hijacking or unauthorized access to organizational data within the dashboard.
CVE-2026-9809 is a stored Cross-Site Scripting (XSS) vulnerability in Mautic version 7.0.0 affecting the Projects component. It occurs when project names supplied by authenticated users with project creation or editing permissions are rendered without proper sanitization in administrative detail views. This allows malicious scripts to execute in the browser context of administrative users who view or hover over compromised project tags, potentially enabling unauthorized administrative actions or data exfiltration.
CVE-2026-9808 is an authorization bypass vulnerability in Mautic 7.0.0 API v2 endpoints. Roles with owner-scope restrictions such as 'viewown' or 'editown' are not properly enforced, allowing low-privilege authenticated API users to access or modify resources owned by other users. This vulnerability has a high severity with a CVSS score of 7.1.
CVE-2026-9559 is a critical path traversal vulnerability in Mautic version 7.0.0 affecting the campaign import feature. It allows an authenticated user with campaign import privileges to write arbitrary PHP files outside the intended temporary directories by exploiting improper validation of ZIP file extraction paths. This can lead to remote code execution under the web server user context.
CVE-2026-9558 is a critical Server-Side Template Injection (SSTI) vulnerability in Mautic's theme engine. It allows authenticated users with theme creation or upload permissions to execute arbitrary code on the hosting server or access restricted system files. The vulnerability arises because the platform renders uploaded Twig templates without sandboxing or strict function restrictions. This can lead to remote code execution and full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-9557 is a Server-Side Request Forgery (SSRF) vulnerability in Mautic's Focus component. It allows an authenticated user to cause the hosting server to make HTTP requests to arbitrary internal or external destinations due to insufficient validation of user-supplied URLs. This can enable internal network reconnaissance or interaction with unintended network resources. The vulnerability affects specific versions 4.0.0, 5.0.0, 6.0.0, and 7.0.0 of Mautic. The CVSS score is 6.4, indicating a medium severity level. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-4776 is an SQL injection vulnerability in Mautic's API contact filtering mechanism. It arises from insufficient recursive sanitization of nested query parameters, allowing an authenticated API user to bypass input filtering and inject arbitrary SQL commands. The vulnerability affects specific versions of Mautic. The CVSS score is 7.1, indicating a high severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.