PT-2025-36607 · Packagist · Mautic/Core

Published 2025-09-03 · Updated 2025-09-03

OSV

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Summary

A user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available.

Impact

An administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.

Fix

Weakness Enumeration

CWE-283

Related Identifiers

GHSA-438M-6MHW-HQ5W

Affected Products

Mautic/Core

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9822 · Security Note
• https://osv.dev/vulnerability/GHSA-438m-6mhw-hq5w · Vendor Advisory
• https://github.com/mautic/mautic/security/advisories/GHSA-438m-6mhw-hq5w · Note
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/commit/882c2c5be646e36f7b91e7c4b24f71aafa617cd5 · Note
• https://github.com/mautic/mautic/commit/a310b1933de7cfefec03382a4d8c0d9dbbaa0600 · Note