mautic vulnerabilities and fixes

Recent CVEs affecting mautic, with upgrade or downgrade steps. 18 tracked.

mautic has 18 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 17. Most recent: 2026-02-24. Highest priority: CVE-2024-47051 (score 51/100).

• CVE-2026-3105 HIGH 7.6 UPGRADE SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact a
• CVE-2024-47059 MEDIUM 4.3 DOWNGRADE When logging in with the correct username and incorrect weak password, the user receives the notification, tha
• CVE-2024-47058 LOW 2.9 UPGRADE With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed
• CVE-2024-47055 MEDIUM 4.3 UPGRADE SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality
• CVE-2024-47053 HIGH 7.7 UPGRADE This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation
• CVE-2024-47051 CRITICAL 9.1 UPGRADE This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3
• CVE-2024-47050 MEDIUM 5.4 UPGRADE Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page U
• CVE-2022-25777 MEDIUM 6.5 UPGRADE Prior to the patched version, an authenticated user of Mautic could read system files and access the internal
• CVE-2022-25776 HIGH 8.3 UPGRADE Prior to the patched version, logged in users of Mautic are able to access areas of the application that they
• CVE-2022-25775 MEDIUM 6.6 UPGRADE Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in th
• CVE-2022-25774 MEDIUM 4.8 UPGRADE Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the noti
• CVE-2022-25773 MEDIUM 4.3 UPGRADE This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended di
• CVE-2022-25770 HIGH 7.8 UPGRADE Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off corre
• CVE-2022-25769 HIGH 7.2 UPGRADE ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP f
• CVE-2022-25768 HIGH 7.0 UPGRADE The logic in place to facilitate the update process via the user interface lacks access control to verify if p
• CVE-2021-27917 HIGH 7.3 UPGRADE Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.
• CVE-2021-27916 HIGH 8.1 UPGRADE Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary Fi
• CVE-2021-27915 HIGH 7.6 UPGRADE Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic applic

FAQ

How do I fix mautic vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is mautic being exploited right now?

None of the tracked mautic CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which mautic CVE should I patch first?

CVE-2024-47051 currently ranks highest (51/100): This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3.

RSS feed for mautic · ← Back to latest CVEs