CVE-2022-25769

Name of the Vulnerable Software and Affected Versions Mautic versions prior to 3.3.5 Mautic versions prior to 4.2.0

Description The default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. However, the regex in the second FilesMatch only checks the filename, not the full path, which is incorrect logic. This issue can enable local host attacks due to an improper validation flaw.

Recommendations For Mautic versions prior to 3.3.5, please upgrade to version 3.3.5 or later. For Mautic versions prior to 4.2.0, please upgrade to version 4.2.0 or later. As a temporary workaround, consider restricting access to the .htaccess file until a patch is applied.