CVE-2026-9557
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.
Risk Assessment
An attacker can use the server to scan the internal network, access internal services (e.g., databases, APIs), or launch attacks on external systems, masking their activity as traffic from a trusted server.
Recommendation
Update Mautic to the latest patched version. Restrict access to the Focus component to trusted users and apply strict firewall rules.
Other vulnerabilities in Mautic
See all- CVE-2017-1000046High
Mautic version 2.6.1 and earlier fails to set flags on session cookies, which may lead to unauthorized access to user sessions.
- CVE-2017-8874High
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that can (1) delete email campaigns or (2) delete contacts.
- CVE-2026-9559Critical
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges can write arbitrary PHP files to sensitive system directories, leading to Remote Code Execution (RCE) under the web server user context.
- CVE-2026-9558Critical
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions, allowing authenticated users with theme creation or upload permissions to achieve remote code execution (RCE) and access restricted system files and configuration.
- CVE-2026-9811Medium
In Mautic 7, a stored XSS vulnerability exists in the project selector component. The application fails to sanitize project names returned via AJAX before injecting them into the DOM, allowing an authenticated user to store a malicious script.
- CVE-2026-9809High
A stored XSS vulnerability exists in the Projects component of Mautic 7. User-supplied project names are rendered without proper sanitization in administrative views, allowing injection of malicious scripts.
- CVE-2026-9808High
An authorization bypass vulnerability exists in Mautic 7 API v2 (API Platform). Roles with owner-scope restrictions (e.g., `viewown`, `editown`) are not properly enforced, allowing low-privilege authenticated users to access or modify resources belonging to other users.
- CVE-2026-4776High
An SQL injection vulnerability in Mautic's API contact filtering mechanism. An authenticated API user can bypass input filtering and inject arbitrary SQL commands due to insufficient recursive sanitization of nested query parameters.
Original NVD description (English source)
A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.