p PatchFirst

CVE-2025-13828

CVE-2025-13828 · Mautic user without privileged access to the Marketplace can install and uninstall composer packages

This page contains facts from public vulnerability sources. Check the original advisory before updating.

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.

CVSS 9.0 · Critical · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • mautic

    Versions
    • <4.4.18, <5.2.9, <6.0.7: Affected (semver)

    No fix published

  • mautic/core Packagist

    Versions
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 4.1.1
    • 4.1.2
    • 4.2.0
    • 4.2.0-rc
    • 4.2.0-rc1
    • 4.2.1
    • 4.2.2
    • 4.3.0
    • 4.3.0-beta
    • 4.3.0-rc
    • 4.3.1
    • 4.4.0
    • 4.4.0-beta
    • 4.4.1
    • 4.4.10
    • 4.4.11
    • 4.4.12
    • 4.4.13
    • 4.4.2
    • 4.4.3
    • 4.4.4
    • 4.4.5
    • 4.4.6
    • 4.4.7
    • 4.4.8
    • 4.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, < 4.4.18

    Update to 4.4.18

  • mautic/core Packagist

    Versions
    • 5.0.0
    • 5.0.1
    • 5.0.2
    • 5.0.3
    • 5.0.4
    • 5.1.0
    • 5.1.1
    • 5.2.0
    • 5.2.1
    • 5.2.2
    • 5.2.3
    • 5.2.4
    • 5.2.5
    • 5.2.6
    • 5.2.7
    • 5.2.8
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 5.2.9

    Update to 5.2.9

  • mautic/core Packagist

    Versions
    • 6.0.0
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0.5
    • 6.0.6
    Affected ranges
    • ECOSYSTEM: ≥ 6.0.0, < 6.0.7

    Update to 6.0.7

Original sources

Check your server →