Mautic vulnerabilities
We track 8 vulnerabilities in Mautic products across 2 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on February 24, 2026.
Latest Mautic vulnerabilities
- 8.8 High severity
Mautic: Improper Neutralization of Special Elements used in an SQL Command
SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort
- 9.0 Critical severity
Mautic: Missing Authorization
SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malici
- 8.8 High severity
Mautic: Unrestricted Upload of File with Dangerous Type
Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf the media folder is not restricted from running files this can lead to a remote code execution.
- 7.7 High severity
mautic/core: Improper Authorization
This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data. * Improper Authorization: An authorization flaw exists in Mautic's API Authorizatio
- 9.9 Critical severity
mautic/core: Relative Path Traversal
This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. * Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has be
- 7.5 High severity
Mautic: Missing Authentication for Critical Functionality
Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vuln
- 7.2 High severity
Mautic: Improper Neutralization of Special Elements used in an SQL Command
Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate
- 9.1 Critical severity
Mautic: Improper Validation of Specified Quantity in Input
ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the