John Linhart

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 7.1.2 **Description** A stored Cross-Site Scripting (XSS) issue exists in the project selector component. The application fails to sanitize project names returned via AJAX before injecting them into the Document Object Model (DOM) as option fields. An authenticated user with project creation permissions can store a malicious script payload in a project name. When an administrative user opens an entity editor containing the project selector, the script executes in their browser session, potentially leading to session hijacking, unauthorized state coordination, or unauthorized access to organizational data. **Recommendations** Update to version 7.1.2. Restrict project creation and modification permissions to trusted administrative users.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** A Server-Side Request Forgery (SSRF) exists in the Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server. This allows for internal network reconnaissance or forcing requests to arbitrary internal or external destinations. SSRF is a flaw where an attacker can abuse server functionality to read or update internal resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 7.1.2 **Description** A stored Cross-Site Scripting (XSS) issue exists in the Projects component. When administrative detail views for campaigns, emails, or forms display project tags and popovers, user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can inject malicious script payloads. When an administrator hovers over a tag associated with a compromised project, the script executes in their browser session, potentially allowing the attacker to perform administrative actions, change system configurations, or exfiltrate sensitive data. **Recommendations** Update to version 7.1.2. Restrict project creation and modification permissions to trusted administrative users.

**Name of the Vulnerable Software and Affected Versions** Mautic versions 7.0.0 through 7.1.1 **Description** An authorization bypass exists in the API v2 endpoints (utilizing API Platform). Roles configured with owner-scope restrictions, such as `viewown` or `editown`, are not properly enforced. This allows authenticated API users with low privileges to bypass ownership-logic controls to access or modify resources belonging to other users, including reports, contacts, and companies, thereby bypassing structural tenant and privilege boundaries. **Recommendations** Update to version 7.1.2. Temporarily revoke API credentials or narrow access permissions for users whose roles rely on owner-scope permission containment.

**Name of the Vulnerable Software and Affected Versions** Mautic versions 7.0.0 through 7.1.1 **Description** A path traversal flaw exists in the campaign import feature. During the extraction of uploaded ZIP files, a validation error allows file paths to exit the designated temporary directories. An authenticated user with `campaign:imports:create` privileges can write arbitrary PHP files to sensitive system directories, potentially overwriting internal configuration or cache components. This can lead to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a remote machine, under the context of the web server user. **Recommendations** Update to version 7.1.2. Revoke `campaign:imports:create` permissions from non-administrative users.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** A Server-Side Template Injection (SSTI) issue exists in the theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can exploit this to achieve Remote Code Execution (RCE), allowing the execution of arbitrary code on the hosting server, or to access restricted system files and configuration settings. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The issue concerns unauthorized access to unpublished page previews in Mautic, which could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information. The page preview functionality for unpublished content, accessible via predictable URLs (e.g., "/page/preview/1", "/page/preview/2"), lacked proper authorization checks, allowing any unauthenticated user to view content not yet intended for public release. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. **Description** A file placement issue exists, allowing assets to be uploaded to unintended server directories. This is due to improper limitation of a pathname to a restricted directory, specifically in the asset upload functionality. This enables users to upload files outside of the intended temporary directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The issue concerns an authorization flaw in Mautic's HTTP Basic Authentication implementation, allowing unauthorized access to sensitive report data. Specifically, an improper authorization flaw exists in Mautic's API Authorization implementation, enabling any authenticated user to access all reports and their associated data via the API, bypassing intended access controls. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 **Description** With access to edit a Mautic form, an attacker can add Cross-Site Scripting stored in the `html` field. This could be used to steal sensitive information from the user's current session. **Recommendations** For versions prior to 4.4.13, upgrade to 4.4.13 or later. For versions prior to 5.1.1, upgrade to 5.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 **Description** A stored XSS issue existed in the contact tracking and page hits report, allowing for potential malicious script execution. **Recommendations** For versions prior to 4.4.13, update to 4.4.13 or later. For versions prior to 5.1.1, update to 5.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 **Description** The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to the patch being applied, it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required. **Recommendations** Upgrade to version 4.4.13 or later. Upgrade to version 5.1.1 or later. As a temporary workaround, consider disabling the update process via the user interface until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The upgrade logic in Mautic's application update via an upgrade script is not properly shielded, potentially leading to a vulnerable situation. However, this issue is mitigated by the fact that Mautic must be installed in a specific way to be vulnerable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 **Description** The issue concerns Cross-Site Scripting through the `Page URL` variable in Mautic's tracking. This allows for potential exploitation. **Recommendations** For versions prior to 4.4.13, update to 4.4.13 or later. For versions prior to 5.1.1, update to 5.1.1 or later. As a temporary workaround, consider restricting the use of the `Page URL` variable in Mautic's tracking until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 5.1.1 **Description** The application responds differently when logging in with a correct username and incorrect weak password versus an incorrect username and weak password. This difference could be used to perform username enumeration. When a correct username is used with an incorrect weak password, the user receives a notification stating that their password is too weak. In contrast, when an incorrect username is provided alongside a weak password, the application responds with an 'Invalid credentials' notification. **Recommendations** Update to version 5.1.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 **Description** An authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability. This issue allows an attacker to access sensitive information. **Recommendations** Update to version 4.4.12 or later. Update to version 5.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 **Description** Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names. **Recommendations** Update to version 4.4.12 to resolve the issue for versions prior to 4.4.12. Update to version 5.0.4 to resolve the issue for versions prior to 5.0.4.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 **Description** The issue affects logged in users of Mautic, making them vulnerable to an SQL injection vulnerability in the Reports bundle. This vulnerability allows an attacker to retrieve and alter sensitive data, including login information. Depending on the database permissions, the attacker may also be able to manipulate file systems. **Recommendations** Update to version 4.4.12 or later. Update to version 5.0.4 or later. As a temporary workaround, consider restricting access to the Reports bundle until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.12 **Description** The issue is related to a self XSS vulnerability in the notifications within Mautic. Logged in users are vulnerable to this issue, which allows malicious code to be injected into the notification when saving Dashboards. **Recommendations** Update to Mautic 4.4.12 to resolve the issue. As a temporary workaround, consider restricting the ability to save Dashboards or injecting custom code into notifications until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 **Description** Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files. This vulnerability exists in the implementation of the GrapesJS builder in Mautic. **Recommendations** Update to version 4.4.12 or later. Update to version 5.0.4 or later. As a temporary workaround, consider restricting access to the GrapesJS builder in Mautic until a patch is applied.