mautic/core vulnerabilities
CVEs whose affected-version data names the mautic/core package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-9557Medium· 6.4Mautic Focus component Vulnerable to SSRF
Mautic Focus component Vulnerable to SSRF
▾ Sunlitmautic · mautic/coreEPSS 0.15%via GHSA
CVE-2026-9558Critical· 9.9PoCMautic has Server-Side Template Injection (SSTI) in Theme Templates
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
▾ Abyssalmautic · mautic/coreEPSS 0.57%via GHSA
CVE-2026-9559Critical· 9.9Mautic vulnerable to Path Traversal via Campaign Import
Mautic vulnerable to Path Traversal via Campaign Import
▾ Midnightmautic · mautic/coreEPSS 0.58%via GHSA
CVE-2026-9808High· 7.1Mautic has an Authorization Bypass in API v2 Endpoints
Mautic has an Authorization Bypass in API v2 Endpoints
▾ Twilightmautic · mautic/coreEPSS 0.20%via GHSA
CVE-2026-9809High· 7.6PoCMautic has Stored Cross-Site Scripting (XSS) in Projects Component
Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
▾ Midnightmautic · mautic/coreEPSS 0.21%via GHSA
CVE-2026-9811Medium· 5.4PoCMautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
▾ Twilightmautic · mautic/coreEPSS 0.17%via GHSA
CVE-2026-4776High· 7.1Mautic has SQL Injection in API Contact Filtering
Mautic has SQL Injection in API Contact Filtering
▾ Twilightmautic · mautic/coreEPSS 0.22%via GHSA