Mautic vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-3105 SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities.High 7.6 · Feb 24, 2026
• CVE-2025-13828 SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enabCritical 9 · Dec 2, 2025
• CVE-2025-13827 Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted.High 8.8 · Dec 2, 2025
• CVE-2024-47053 This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation.High 7.7 · Feb 26, 2025
• CVE-2024-47051 This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3.Critical 9.1 · Feb 26, 2025
• CVE-2022-25770 Mautic allows you to update the application via an upgrade script.High 7.8 · Sep 18, 2024
• CVE-2021-27917 Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.High 7.3 · Sep 18, 2024
• CVE-2022-25768 The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks.High 7 · Sep 18, 2024
• CVE-2022-25776 Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing.High 8.3 · Sep 18, 2024
• CVE-2022-25769 ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the applicationHigh 7.2 · Sep 18, 2024
• CVE-2021-27916 Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion.High 8.1 · Sep 17, 2024
• CVE-2021-27915 Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in userHigh 7.6 · Sep 17, 2024
• CVE-2022-25772 A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascriptCritical 9.6 · Jun 20, 2022
• CVE-2021-27914 A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascriptHigh 7.6 · Jun 1, 2022
• CVE-2021-27912 Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken High 7.1 · Aug 30, 2021
• CVE-2021-27911 Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's detHigh 8.3 · Aug 30, 2021
• CVE-2021-27910 Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function.High 8.2 · Aug 30, 2021
• CVE-2020-35129 Mautic before 3.2.4 is affected by stored XSS.Critical 9 · Jan 19, 2021
• CVE-2018-8092 Mautic before 2.13.0 allows CSV injection.Critical 9.8 · Apr 18, 2018
• CVE-2018-10189 An issue was discovered in Mautic 1.x and 2.x before 2.13.0.High 7.5 · Apr 17, 2018
• CVE-2017-1000046 Mautic 2.6.1 and earlier fails to set flags on session cookiesHigh 7.5 · Jul 17, 2017