GitHub Advisoryadvisory · Packagist

GHSA-438m-6mhw-hq5w Mautic vulnerable to secret data extraction via elfinder

MEDIUM Published 2025-09-03 Modified 2025-09-03 Official page ↗
Aliases
CVE-2025-9822
Ecosystem
Packagist
Packages
mautic/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-283
Reviewed
2025-09-03

Affected packages

• Packagist mautic/core: >= 4.4.0, < 4.4.17 → fixed in 4.4.17 • Packagist mautic/core: >= 5.0.0-alpha, < 5.2.8 → fixed in 5.2.8 • Packagist mautic/core: >= 6.0.0-alpha, < 6.0.5 → fixed in 6.0.5

Description

Summary _A user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available._ Impact _An administrator who usually does not have access to certain parameters, such as database credentials, can disclose them._

Related

Alias · CVE (1)

  • CVE-2025-9822 SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally… vulnerability

Weakness · CWE (1)

  • CWE-283 Unverified Ownership weakness

References