Patryk Gruszka

An unrestricted file upload issue exists in the campaign import feature. When processing a campaign archive, the application copies bundled asset files into a publicly accessible media directory without restricting file names or types. An authenticated user with permissions to create campaign imports can exploit this via the user interface or the '/api/campaigns/import' endpoint to place arbitrary files, such as server-side scripts, in the web root. This does not require administrator privileges. On web servers that honor per-directory configuration, such as the default Apache setup in the official Mautic Docker image, this can lead to remote code execution with the privileges of the web server user, granting access to application secrets, configuration, and contact data.

An open redirect occurs at the '/form/submit' endpoint. The application redirects visitors to a return address provided during submission without verifying if the destination is the Mautic instance or a trusted host. An unauthenticated attacker can use this to redirect users from a legitimate domain to external sites, such as phishing pages or malware distribution sites. This requires the victim to submit a form prepared by the attacker.

A broken access control issue exists in the Mautic Stats API endpoint '/api/stats/{table}'. The system failed to enforce permissions for several internal tables, as administrator-only restrictions were not applied and tables lacking explicit permission mappings remained readable by default. Consequently, any authenticated API user, regardless of their assigned role or permissions, can access sensitive data. This includes the application audit log containing user actions and change details that may expose personal contact data, visitor IP addresses, geolocation details, and tracked redirect URLs with channel mappings.

A path traversal issue exists in the Mautic Asset API. An authenticated API user with permissions to create assets can specify a file path that is not restricted to the asset upload directory. This allows the registration of any file readable by the web server process as a Mautic asset. Once published, the public download URL serves the file contents without authentication, enabling the retrieval of arbitrary server files, such as system files and configuration files containing secret keys, database passwords, and SMTP credentials.

A stored Cross-Site Scripting (XSS) issue exists in the contact detail view. HTML-type custom contact fields are rendered without output sanitization, allowing a user or integration to store a script payload via contact editing, the contact API, or form submissions mapped to the field. When an administrator or another user views the affected contact's detail page, the script executes in their browser session. This can lead to unauthorized administrative actions, including the creation of new administrator accounts, modification of system configurations, or unauthorized access to campaign and contact data.

An SQL Injection issue exists in the dashboard widget data API endpoint '/api/data/{type}'. This occurs because chart filter parameters provided by the client are not properly validated before being used in database queries that generate dashboard chart data. An authenticated user with API access can use blind SQL injection—a technique used to retrieve data from a database by asking true/false questions—to read arbitrary information from the database, including contact details, marketing data, and user account password hashes. Additionally, the injected SQL can be used to slow down queries, potentially impacting availability. Data modification is not possible, and exploitation requires the Mautic API to be enabled.

A SQL injection issue exists in the Mautic administration interface at the '/s/ajax' endpoint. The problem occurs because a request parameter used to select the contact field for searching is not properly validated before being included in a database query. Any authenticated user, regardless of their assigned role or permissions, can exploit this using blind techniques—such as boolean-based or time-based methods—to execute arbitrary SQL queries. This allows the attacker to read sensitive information from the database, including user accounts, email addresses, password hashes, contact data, and campaign content.

An insecure deserialization issue, specifically PHP object injection, occurs during the handling of segment filters and custom field properties. Certain code paths deserialize stored values from the database without restricting the PHP classes that can be instantiated, bypassing the safe deserialization helper. An attacker with high privileges or the ability to write to the affected stored data can inject crafted serialized values. When Mautic processes this data during segment evaluation, contact export, or custom field API requests, arbitrary PHP objects are instantiated. Using gadget chains—sequences of existing code fragments that can be leveraged for unintended purposes—within dependencies, this can lead to arbitrary code execution on the server, unauthorized access, modification, or deletion of contact data, and service disruption.

A server-side template injection occurs in the Twig theme rendering sandbox. The sandbox, designed to restrict user-uploaded theme templates, fails to fully enforce restrictions, allowing a crafted template to escape. An authenticated user with the `core:themes:create` permission can upload a malicious theme that, when rendered, enables arbitrary code execution with the privileges of the web server process. This allows for the execution of operating system commands, reading of server-side files such as configuration files and database credentials, writing files, and accessing internal services.

A stored Cross-Site Scripting (XSS) issue exists in the project selector component. The application fails to sanitize project names returned via AJAX before injecting them into the Document Object Model (DOM) as option fields. An authenticated user with project creation permissions can store a malicious script payload in a project name. When an administrative user opens an entity editor containing the project selector, the script executes in their browser session, potentially leading to session hijacking, unauthorized state coordination, or unauthorized access to organizational data.

An SQL injection occurs in the API contact filtering mechanism. This issue arises from insufficient recursive sanitization of nested query parameters, allowing an authenticated API user to bypass input filtering and execute arbitrary SQL commands.

A Server-Side Request Forgery (SSRF) exists in the Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server. This allows for internal network reconnaissance or forcing requests to arbitrary internal or external destinations. SSRF is a flaw where an attacker can abuse server functionality to read or update internal resources.

A Server-Side Template Injection (SSTI) issue exists in the theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can exploit this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.

A path traversal flaw exists in the campaign import feature. During the extraction of uploaded ZIP files, a validation error allows file paths to exit the designated temporary directories. An authenticated user with `campaign:imports:create` privileges can write arbitrary PHP files to sensitive system directories, potentially overwriting internal configuration or cache components. This can lead to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a remote machine, under the context of the web server user.

An authorization bypass exists in the API v2 endpoints (utilizing API Platform). Roles configured with owner-scope restrictions, such as `viewown` or `editown`, are not properly enforced. This allows authenticated API users with low privileges to bypass ownership-logic controls to access or modify resources belonging to other users, including reports, contacts, and companies, thereby bypassing structural tenant and privilege boundaries.

A stored Cross-Site Scripting (XSS) issue exists in the Projects component. When administrative detail views for campaigns, emails, or forms display project tags and popovers, user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can inject malicious script payloads. When an administrator hovers over a tag associated with a compromised project, the script executes in their browser session, potentially allowing the attacker to perform administrative actions, change system configurations, or exfiltrate sensitive data.

A user with limited privileges can bypass restrictions related to Composer and install or remove packages. This can occur even if the platform's update settings have Composer-based updates disabled. This allows a low-privileged user to potentially install malicious code and escalate their privileges on the system.

The GrapesJS Builder allows the upload of arbitrary files due to a lack of file type restrictions. If the media folder is not configured to prevent file execution, this could lead to remote code execution.

The issue is related to the segment cloning functionality in Mautic, allowing any authenticated user to clone segments without proper authorization checks due to a missing authorization vulnerability in the cloneAction of the segment management. This enables an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.

The issue is related to an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits. The vulnerability exists in the "/s/action/unlock/user.user/0" endpoint, where the `returnUrl` parameter is not properly validated, allowing an attacker to craft a URL that redirects users to an arbitrary external website.