CVE-2026-9809
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A stored XSS vulnerability exists in the Projects component of Mautic 7. User-supplied project names are rendered without proper sanitization in administrative views, allowing injection of malicious scripts.
Risk Assessment
An attacker with project creation or editing permissions can hijack an administrator's session, perform administrative actions, alter system configurations, or exfiltrate sensitive data.
Recommendation
Immediately update Mautic to the patched version and enforce input validation and encoding for project names.
Other vulnerabilities in Mautic
See all- CVE-2017-1000046High
Mautic version 2.6.1 and earlier fails to set flags on session cookies, which may lead to unauthorized access to user sessions.
- CVE-2017-8874High
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that can (1) delete email campaigns or (2) delete contacts.
- CVE-2026-9559Critical
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges can write arbitrary PHP files to sensitive system directories, leading to Remote Code Execution (RCE) under the web server user context.
- CVE-2026-9558Critical
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions, allowing authenticated users with theme creation or upload permissions to achieve remote code execution (RCE) and access restricted system files and configuration.
- CVE-2026-9811Medium
In Mautic 7, a stored XSS vulnerability exists in the project selector component. The application fails to sanitize project names returned via AJAX before injecting them into the DOM, allowing an authenticated user to store a malicious script.
- CVE-2026-9808High
An authorization bypass vulnerability exists in Mautic 7 API v2 (API Platform). Roles with owner-scope restrictions (e.g., `viewown`, `editown`) are not properly enforced, allowing low-privilege authenticated users to access or modify resources belonging to other users.
- CVE-2026-9557Medium
A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.
- CVE-2026-4776High
An SQL injection vulnerability in Mautic's API contact filtering mechanism. An authenticated API user can bypass input filtering and inject arbitrary SQL commands due to insufficient recursive sanitization of nested query parameters.
Original NVD description (English source)
A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can exploit this to inject malicious script payloads. When an administrative user views an entity associated with a compromised project and hovers over its tag, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, alter system configurations, or exfiltrate sensitive data.