First PHP, now Mautic
On 21 October, the PHP team published a security advisory covering two critical RCE vulnerabilities that can allow unauthenticated remote code execution. Fixes were released in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Updating Mautic alone will not fix these PHP vulnerabilities. Install the patches for your PHP version or the updated packages from your system vendor too. If you change PHP versions, check compatibility with Mautic.
What the release covers
Mautic 7.2.2 fixes eight vulnerabilities, while 6.0.10 and 5.2.12 fix seven each. That is nine distinct vulnerabilities in total, with some affecting several branches.
- Mautic 7.2.2 — eight security fixes and bug fixes for branch 7.
- Mautic 6.0.10 — seven security fixes for branch 6.
- Mautic 5.2.12 — seven security fixes for branch 5.
- Mautic 4.4.21 ELTS — a release for Extended Long Term Support programme participants.
Which issues were fixed
The fixes cover a Twig sandbox escape in theme templates, SQL injection in contact lookup and the dashboard widget API, file reads through path traversal in the asset API, broken access control in the stats API and an open redirect during form submission. Mautic 7.2.2 also fixes stored XSS in an HTML-type contact field.
The fixes differ between branches. For example:
- CVE-2026-115188: remote code execution during campaign import affects Mautic 7 and was fixed in 7.2.2. Exploitation requires an account with campaign import permission; the impact also depends on the server configuration.
- CVE-2026-115190: insecure deserialization in segment filters and custom fields was fixed in 5.2.12 and 6.0.10. In branch 7, the fix was already available from 7.2.0.
The linked advisories list the affected versions and explain what is needed to exploit each vulnerability.
My contribution to the release
As Release Leader, I coordinated releases 7.2.2, 6.0.10 and 5.2.12. I prepared the fixes for remote code execution during campaign import and insecure deserialization in segment filters and custom fields. I also reviewed the fixes for the other vulnerabilities.
Thanks to the security researchers, Jan Linhart, Martin Vooremäe and release sponsor Leuchtfeuer Digital Marketing GmbH.
ELTS 4.4.21 for programme participants
Alongside the community releases, I prepared Mautic 4.4.21 under Extended Long Term Support (ELTS). The release is available to programme participants.
How to prepare for the upgrade
- Check your current Mautic version, the target release requirements and plugin and integration compatibility.
- Back up the database, files and configuration. Verify that the backup can be restored.
- Upgrade a test environment with outbound messages disabled and prepare a rollback plan.
- Check campaigns, forms, themes, API, integrations, cron jobs, queues and logs.
- Deploy during an agreed maintenance window, repeat the tests and monitor the installation.
I covered upgrade preparation in more detail in my article on Mautic 7.1.2.