---
id: CVE-2025-13828
title: >-
  SummaryA non privileged user can install and remove arbitrary packages via
  composer for a composer based installed, even if the flag in update settings
  for enable composer based update is unticked.


  ImpactA low-privileged user of the pla…
summary: >-
  SummaryA non privileged user can install and remove arbitrary packages via
  composer for a composer based installed, even if the flag in update settings
  for enable composer based update is unticked.


  ImpactA low-privileged user of the pla…
severity: none
cwe:
  - CWE-862
published: '2025-12-02'
updated: '2026-09-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13828'
references:
  - url: 'https://github.com/mautic/mautic/security/advisories/GHSA-3fq7-c5m8-g86x'
    label: security@mautic.org
tags:
  - nvd
epss: 0.00246
epssPercentile: 0.14071
ingestedAt: '2026-09-03T03:55:24.073Z'
---

## Overview

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.

ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.