# Mautic vulnerabilities Source: https://junglewise.ai/threats/vendors/mautic Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/mautic.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in Mautic: 0 in the last 7 days and 9 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115196, was published on 26 October 2026. 9 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 9 - Last 90 days: 9 - All time: 17 (3 critical, 0 exploited in the wild) ## About Mautic Mautic is an open-source marketing automation software provider. ## Latest Mautic vulnerabilities - [CVE-2026-115196: Mautic open redirect in form submission endpoint](https://junglewise.ai/threats/cve-2026-115196-an-open-redirect-vulnerability-exists-in-the-public-form) (medium, CVSS 5.4, published 26 Oct 2026) - [CVE-2026-115195: Mautic Stats API broken access control in permission enforcement](https://junglewise.ai/threats/cve-2026-115195-a-broken-access-control-vulnerability-exists-in-the-mautic-stats) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-115194: Mautic Asset API path traversal vulnerability](https://junglewise.ai/threats/cve-2026-115194-a-path-traversal-vulnerability-exists-in-the-mautic-asset-api) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-115193: Mautic stored XSS in HTML-type custom contact fields](https://junglewise.ai/threats/cve-2026-115193-a-stored-cross-site-scripting-xss-vulnerability-exists-in-the) (high, CVSS 8.2, published 26 Oct 2026) - [CVE-2026-115192: Mautic SQL injection in dashboard widget API](https://junglewise.ai/threats/cve-2026-115192-an-sql-injection-vulnerability-exists-in-the-dashboard-widget) (high, CVSS 7.1, published 26 Oct 2026) - [CVE-2026-115191: Mautic SQL injection in contact lookup AJAX endpoint](https://junglewise.ai/threats/cve-2026-115191-a-sql-injection-vulnerability-exists-in-a-contact-lookup-ajax) (high, CVSS 7.1, published 26 Oct 2026) - [CVE-2026-115190: Mautic insecure deserialization in segment filters and custom fields](https://junglewise.ai/threats/cve-2026-115190-an-insecure-deserialization-php-object-injection-vulnerability) (high, CVSS 8, published 26 Oct 2026) - [CVE-2026-115189: Mautic Twig sandbox escape in theme templates](https://junglewise.ai/threats/cve-2026-115189-a-server-side-template-injection-vulnerability-exists-in-the) (high, CVSS 8.8, published 26 Oct 2026) - [CVE-2026-115188: Mautic unrestricted file upload in campaign import](https://junglewise.ai/threats/cve-2026-115188-an-unrestricted-file-upload-vulnerability-exists-in-the-campaign) (critical, CVSS 9.9, published 26 Oct 2026) - [CVE-2026-9811: Mautic stored XSS in project selector component](https://junglewise.ai/threats/cve-2026-9811-mautic-stored-xss-in-project-selector-component) (medium, CVSS 5.4, published 29 May 2026) - [CVE-2026-9809: Mautic stored XSS in Projects component project tags](https://junglewise.ai/threats/cve-2026-9809-mautic-stored-xss-in-projects-component-project-tags) (high, CVSS 7.6, published 29 May 2026) - [CVE-2026-9808: Mautic Core authorization bypass in API v2 endpoints](https://junglewise.ai/threats/cve-2026-9808-mautic-core-authorization-bypass-in-api-v2-endpoints) (high, CVSS 7.1, published 29 May 2026) - [CVE-2026-9559: Mautic path traversal in campaign import feature](https://junglewise.ai/threats/cve-2026-9559-mautic-path-traversal-in-campaign-import-feature) (critical, CVSS 9.9, published 29 May 2026) - [CVE-2026-9558: Mautic Server-Side Template Injection in theme engine](https://junglewise.ai/threats/cve-2026-9558-mautic-server-side-template-injection-in-theme-engine) (critical, CVSS 9.9, published 29 May 2026) - [CVE-2026-9557: Mautic Focus component Server-Side Request Forgery](https://junglewise.ai/threats/cve-2026-9557-mautic-focus-component-server-side-request-forgery) (medium, CVSS 6.4, published 29 May 2026) - [CVE-2026-4776: Mautic SQL injection in API contact filtering](https://junglewise.ai/threats/cve-2026-4776-mautic-sql-injection-in-api-contact-filtering) (high, CVSS 7.1, published 29 May 2026) - [CVE-2025-13828: Mautic privilege escalation via unauthorized composer package installation](https://junglewise.ai/threats/cve-2025-13828-mautic-privilege-escalation-via-unauthorized-composer-package) (medium, CVSS 4, published 2 Dec 2025) ## Most severe Mautic vulnerabilities - [CVE-2026-9559: Mautic path traversal in campaign import feature](https://junglewise.ai/threats/cve-2026-9559-mautic-path-traversal-in-campaign-import-feature) (critical, CVSS 9.9, published 29 May 2026) - [CVE-2026-9558: Mautic Server-Side Template Injection in theme engine](https://junglewise.ai/threats/cve-2026-9558-mautic-server-side-template-injection-in-theme-engine) (critical, CVSS 9.9, published 29 May 2026) - [CVE-2026-115188: Mautic unrestricted file upload in campaign import](https://junglewise.ai/threats/cve-2026-115188-an-unrestricted-file-upload-vulnerability-exists-in-the-campaign) (critical, CVSS 9.9, published 26 Oct 2026) - [CVE-2026-115189: Mautic Twig sandbox escape in theme templates](https://junglewise.ai/threats/cve-2026-115189-a-server-side-template-injection-vulnerability-exists-in-the) (high, CVSS 8.8, published 26 Oct 2026) - [CVE-2026-115193: Mautic stored XSS in HTML-type custom contact fields](https://junglewise.ai/threats/cve-2026-115193-a-stored-cross-site-scripting-xss-vulnerability-exists-in-the) (high, CVSS 8.2, published 26 Oct 2026) - [CVE-2026-115190: Mautic insecure deserialization in segment filters and custom fields](https://junglewise.ai/threats/cve-2026-115190-an-insecure-deserialization-php-object-injection-vulnerability) (high, CVSS 8, published 26 Oct 2026) - [CVE-2026-9809: Mautic stored XSS in Projects component project tags](https://junglewise.ai/threats/cve-2026-9809-mautic-stored-xss-in-projects-component-project-tags) (high, CVSS 7.6, published 29 May 2026) - [CVE-2026-4776: Mautic SQL injection in API contact filtering](https://junglewise.ai/threats/cve-2026-4776-mautic-sql-injection-in-api-contact-filtering) (high, CVSS 7.1, published 29 May 2026) - [CVE-2026-9808: Mautic Core authorization bypass in API v2 endpoints](https://junglewise.ai/threats/cve-2026-9808-mautic-core-authorization-bypass-in-api-v2-endpoints) (high, CVSS 7.1, published 29 May 2026) - [CVE-2026-115192: Mautic SQL injection in dashboard widget API](https://junglewise.ai/threats/cve-2026-115192-an-sql-injection-vulnerability-exists-in-the-dashboard-widget) (high, CVSS 7.1, published 26 Oct 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 9 | 1 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Mautic technologies - [Mautic](https://junglewise.ai/threats/technologies/mautic): 13 vulnerabilities - [Mautic Core](https://junglewise.ai/threats/technologies/mautic-core): 6 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Mautic vulnerabilities", https://junglewise.ai/threats/vendors/mautic, 9 November 2026.