CVE-2026-115190

Name of the Vulnerable Software and Affected Versions Mautic (affected versions not specified)

Description An insecure deserialization issue, specifically PHP object injection, occurs during the handling of segment filters and custom field properties. Certain code paths deserialize stored values from the database without restricting the PHP classes that can be instantiated, bypassing the safe deserialization helper. An attacker with high privileges or the ability to write to the affected stored data can inject crafted serialized values. When Mautic processes this data during segment evaluation, contact export, or custom field API requests, arbitrary PHP objects are instantiated. Using gadget chains—sequences of existing code fragments that can be leveraged for unintended purposes—within dependencies, this can lead to arbitrary code execution on the server, unauthorized access, modification, or deletion of contact data, and service disruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.