PT-2025-36623 · Packagist · Mautic/Core

Published 2025-09-03 · Updated 2025-09-03

OSV

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Summary

Users with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed

Details

When sending webhooks, the destination is not validated, causing SSRF.

Impact

Bypass of firewalls to interact with internal services. See https://owasp.org/Top10/A10 2021-Server-Side Request Forgery %28SSRF%29/ for more potential impact.

Resources

https://cheatsheetseries.owasp.org/cheatsheets/Server Side Request Forgery Prevention Cheat Sheet.html for more information on SSRF and its fix

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

GHSA-HJ6F-7HP7-XG69

Affected Products

Mautic/Core

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9821 · Security Note
• https://osv.dev/vulnerability/GHSA-hj6f-7hp7-xg69 · Vendor Advisory
• https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69 · Note
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/commit/dc5bb1466c9a48fd34768dc8ff5888716b2916ba · Note
• https://github.com/mautic/mautic/commit/6084f6de4c88d1aeb5f6c73ea4fe1b09c98ea52b · Note