John Linhart

A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project's name. When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** A Server-Side Request Forgery (SSRF) exists in the Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server. This allows for internal network reconnaissance or forcing requests to arbitrary internal or external destinations. SSRF is a flaw where an attacker can abuse server functionality to read or update internal resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can exploit this to inject malicious script payloads. When an administrative user views an entity associated with a compromised project and hovers over its tag, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, alter system configurations, or exfiltrate sensitive data.

An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as `viewown` or `editown`) are not properly enforced. This allows low-privilege authenticated API users to bypass ownership-logic controls and access or modify resources belonging to other users.

A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges (campaign:imports:create) can write arbitrary PHP files to sensitive system directories. An attacker can exploit this to overwrite critical internal configuration or cache components, resulting in Remote Code Execution (RCE) under the context of the web server user.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** A Server-Side Template Injection (SSTI) issue exists in the theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can exploit this to achieve Remote Code Execution (RCE), allowing the execution of arbitrary code on the hosting server, or to access restricted system files and configuration settings. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The issue concerns unauthorized access to unpublished page previews in Mautic, which could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information. The page preview functionality for unpublished content, accessible via predictable URLs (e.g., "/page/preview/1", "/page/preview/2"), lacked proper authorization checks, allowing any unauthenticated user to view content not yet intended for public release. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. **Description** A file placement issue exists, allowing assets to be uploaded to unintended server directories. This is due to improper limitation of a pathname to a restricted directory, specifically in the asset upload functionality. This enables users to upload files outside of the intended temporary directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The issue concerns an authorization flaw in Mautic's HTTP Basic Authentication implementation, allowing unauthorized access to sensitive report data. Specifically, an improper authorization flaw exists in Mautic's API Authorization implementation, enabling any authenticated user to access all reports and their associated data via the API, bypassing intended access controls. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 **Description** With access to edit a Mautic form, an attacker can add Cross-Site Scripting stored in the `html` field. This could be used to steal sensitive information from the user's current session. **Recommendations** For versions prior to 4.4.13, upgrade to 4.4.13 or later. For versions prior to 5.1.1, upgrade to 5.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 **Description** A stored XSS issue existed in the contact tracking and page hits report, allowing for potential malicious script execution. **Recommendations** For versions prior to 4.4.13, update to 4.4.13 or later. For versions prior to 5.1.1, update to 5.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 **Description** The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to the patch being applied, it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required. **Recommendations** Upgrade to version 4.4.13 or later. Upgrade to version 5.1.1 or later. As a temporary workaround, consider disabling the update process via the user interface until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The upgrade logic in Mautic's application update via an upgrade script is not properly shielded, potentially leading to a vulnerable situation. However, this issue is mitigated by the fact that Mautic must be installed in a specific way to be vulnerable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 **Description** The issue concerns Cross-Site Scripting through the `Page URL` variable in Mautic's tracking. This allows for potential exploitation. **Recommendations** For versions prior to 4.4.13, update to 4.4.13 or later. For versions prior to 5.1.1, update to 5.1.1 or later. As a temporary workaround, consider restricting the use of the `Page URL` variable in Mautic's tracking until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 5.1.1 **Description** The application responds differently when logging in with a correct username and incorrect weak password versus an incorrect username and weak password. This difference could be used to perform username enumeration. When a correct username is used with an incorrect weak password, the user receives a notification stating that their password is too weak. In contrast, when an incorrect username is provided alongside a weak password, the application responds with an 'Invalid credentials' notification. **Recommendations** Update to version 5.1.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 **Description** An authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability. This issue allows an attacker to access sensitive information. **Recommendations** Update to version 4.4.12 or later. Update to version 5.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 **Description** Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names. **Recommendations** Update to version 4.4.12 to resolve the issue for versions prior to 4.4.12. Update to version 5.0.4 to resolve the issue for versions prior to 5.0.4.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 **Description** The issue affects logged in users of Mautic, making them vulnerable to an SQL injection vulnerability in the Reports bundle. This vulnerability allows an attacker to retrieve and alter sensitive data, including login information. Depending on the database permissions, the attacker may also be able to manipulate file systems. **Recommendations** Update to version 4.4.12 or later. Update to version 5.0.4 or later. As a temporary workaround, consider restricting access to the Reports bundle until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.12 **Description** The issue is related to a self XSS vulnerability in the notifications within Mautic. Logged in users are vulnerable to this issue, which allows malicious code to be injected into the notification when saving Dashboards. **Recommendations** Update to Mautic 4.4.12 to resolve the issue. As a temporary workaround, consider restricting the ability to save Dashboards or injecting custom code into notifications until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 **Description** Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files. This vulnerability exists in the implementation of the GrapesJS builder in Mautic. **Recommendations** Update to version 4.4.12 or later. Update to version 5.0.4 or later. As a temporary workaround, consider restricting access to the GrapesJS builder in Mautic until a patch is applied.