# CVE-2025-13828: Mautic privilege escalation via unauthorized composer package installation

Source: https://junglewise.ai/threats/cve-2025-13828-mautic-privilege-escalation-via-unauthorized-composer-package  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-13828 · Severity: medium · CVSS 4 · Published 2025-12-02

Mautic, a popular open-source marketing automation platform, contains a vulnerability in its package management system that allows low-privileged users to install and remove arbitrary software packages even when administrators have disabled this feature. An attacker with basic user access can exploit this to install malicious code and escalate privileges to administrator level, potentially gaining full control of the platform and access to all customer data stored within it.

Technologies: [Mautic](https://junglewise.ai/threats/technologies/mautic), [mautic/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-mautic-core). Vendors: [Mautic](https://junglewise.ai/threats/vendors/mautic), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2025-13828 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13828 being exploited in the wild.

**How severe is CVE-2025-13828?** Medium severity, with a CVSS score of 4, published 2 December 2025.

**Which products and versions are affected?** Mautic >=4.0, <4.4.18; 5.0-5.2.8; 6.0-6.0.6; mautic/core (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.4.18.

**Is there a fix for CVE-2025-13828?** Yes. mautic/core (Packagist): upgrade to 4.4.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-13828 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-13828?** Check whether you run Mautic or mautic/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mautic/core (Packagist): upgrade to 4.4.18 or later

  ```sh
  composer require mautic/core:^4.4.18
  ```


## Technical details

This is a privilege escalation vulnerability in Mautic's Marketplace composer integration. A low-privileged user can bypass access controls and invoke composer package installation/removal operations through the platform's API or interface, regardless of whether the administrator has disabled composer-based updates in the settings. The vulnerability affects Mautic versions 4.0 and later. An authenticated low-privilege user (network attack vector, low complexity) can install arbitrary malicious packages that execute with the application's privileges, achieving remote code execution and subsequent privilege escalation. Patches are available in versions 4.4.18, 5.2.9, and 6.0.7.

## Affected products

- Mautic Mautic >=4.0, <4.4.18; 5.0-5.2.8; 6.0-6.0.6

## Identifiers

- CVE-2025-13828
- GHSA-3fq7-c5m8-g86x

## Timeline

- 2025-12-02: disclosed: Published via GitHub Security Advisory GHSA-3fq7-c5m8-g86x and CVE-2025-13828
- 2025-12-02: patched: Fixes released in versions 4.4.18, 5.2.9, and 6.0.7

## References

- [https://packagist.org/](https://packagist.org/)
- [https://github.com/mautic/mautic/security/advisories/GHSA-3fq7-c5m8-g86x](https://github.com/mautic/mautic/security/advisories/GHSA-3fq7-c5m8-g86x)

## Related threats

- [Mautic open redirect in form submission endpoint](https://junglewise.ai/threats/cve-2026-115196-an-open-redirect-vulnerability-exists-in-the-public-form)
- [Mautic Stats API broken access control in permission enforcement](https://junglewise.ai/threats/cve-2026-115195-a-broken-access-control-vulnerability-exists-in-the-mautic-stats)
- [Mautic stored XSS in HTML-type custom contact fields](https://junglewise.ai/threats/cve-2026-115193-a-stored-cross-site-scripting-xss-vulnerability-exists-in-the)
- [Mautic SQL injection in dashboard widget API](https://junglewise.ai/threats/cve-2026-115192-an-sql-injection-vulnerability-exists-in-the-dashboard-widget)
- [Mautic SQL injection in contact lookup AJAX endpoint](https://junglewise.ai/threats/cve-2026-115191-a-sql-injection-vulnerability-exists-in-a-contact-lookup-ajax)