CVE-2025-13828: Mautic privilege escalation via unauthorized composer package installation

CVE-2025-13828 · Severity: medium · CVSS 4 · Published 2025-12-02

Mautic, a popular open-source marketing automation platform, contains a vulnerability in its package management system that allows low-privileged users to install and remove arbitrary software packages even when administrators have disabled this feature. An attacker with basic user access can exploit this to install malicious code and escalate privileges to administrator level, potentially gaining full control of the platform and access to all customer data stored within it.

Technologies: Mautic, mautic/core (Packagist). Vendors: Mautic, Packagist.

Quick answers

Is CVE-2025-13828 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-13828 being exploited in the wild.
How severe is CVE-2025-13828?
Medium severity, with a CVSS score of 4, published 2 December 2025.
Which products and versions are affected?
Mautic >=4.0, <4.4.18; 5.0-5.2.8; 6.0-6.0.6; mautic/core (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.4.18.
Is there a fix for CVE-2025-13828?
Yes. mautic/core (Packagist): upgrade to 4.4.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-13828 attacked?
It is attacked over the network.
Am I affected by CVE-2025-13828?
Check whether you run Mautic or mautic/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mautic/core (Packagist): upgrade to 4.4.18 or later
    composer require mautic/core:^4.4.18

Technical details

This is a privilege escalation vulnerability in Mautic's Marketplace composer integration. A low-privileged user can bypass access controls and invoke composer package installation/removal operations through the platform's API or interface, regardless of whether the administrator has disabled composer-based updates in the settings. The vulnerability affects Mautic versions 4.0 and later. An authenticated low-privilege user (network attack vector, low complexity) can install arbitrary malicious packages that execute with the application's privileges, achieving remote code execution and subsequent privilege escalation. Patches are available in versions 4.4.18, 5.2.9, and 6.0.7.

Affected products

  • Mautic Mautic >=4.0, <4.4.18; 5.0-5.2.8; 6.0-6.0.6

Identifiers

  • CVE-2025-13828
  • GHSA-3fq7-c5m8-g86x

Timeline

  • 2025-12-02: disclosed: Published via GitHub Security Advisory GHSA-3fq7-c5m8-g86x and CVE-2025-13828
  • 2025-12-02: patched: Fixes released in versions 4.4.18, 5.2.9, and 6.0.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.