Mautic 7.2.2 fixes remote code execution, SQL injection and other high-severity flaws

What happened

The Mautic project has published eight security advisories fixed in Mautic 7.2.2, with several also fixed in 6.0.10 and 5.2.12. The most severe, GHSA-mxjf-pghx-h299, is a critical unrestricted file upload in campaign import. An authenticated user with campaign import permission can upload an archive via the UI or /api/campaigns/import, placing server-side scripts in a publicly accessible media directory. On the default Apache setup of the official Mautic Docker image this gives remote code execution as the web server user; administrator privileges are not required.

Other flaws include a Twig sandbox escape in theme templates (GHSA-h7pm-79gc-8867), two SQL injection issues, a stored XSS in HTML-type custom contact fields, broken access control in the Stats API, arbitrary file read through the Asset API, and an open redirect in form submissions. Several require only a low-privileged account; the open redirect needs no authentication and a victim to submit a prepared form. Mautic has not stated active exploitation for any of them, and none is listed in CISA's KEV catalogue.

Who is affected

Affected ranges differ by advisory. Mautic 7 releases before 7.2.2 are affected by all eight advisories. Mautic 6 releases before 6.0.10 and Mautic 5 releases before 5.2.12 are affected by six advisories: GHSA-h7pm-79gc-8867, GHSA-fj8v-c9c3-7q26, GHSA-qpmx-7pq3-5q2v, GHSA-7j28-9rg4-wg63, GHSA-wfhm-289v-79vp, and GHSA-5mm3-3g7p-9868. Those six list affected ranges beginning at various older versions (1.0.0, 2.1.0, 2.3.0 or 2.8.1) through before 5.2.12; no public fixed release is stated for those earlier lines, and Mautic points to ELTS for Mautic 4. The platform is typically a self-managed web application and may expose public forms and APIs.

What to do now

1. Upgrade to the fixed release for your branch: Mautic 7.2.2, Mautic 6.0.10 or Mautic 5.2.12. On Mautic 7, 7.2.2 is the only release that fixes the campaign import and stored XSS flaws; on Mautic 6 or 5, use 6.0.10 or 5.2.12 respectively. If you are on Mautic 4, Mautic says the theme template fix ships through ELTS; for other older branches no public fixed release is listed.
2. If you cannot upgrade immediately, restrict the permissions these flaws need: remove campaign import create permission from users who do not need it; restrict core:themes:create to trusted administrators; disable or restrict the Mautic API; and restrict contact editing and HTML field mapping.
3. For the contact lookup SQL injection, block requests to /s/ajax with the action lead:getLeadIdsByFieldValue at the web server or WAF.
4. For the campaign import flaw, configure the web server at server or virtual-host level to deny script execution in the media/ directory. For the open redirect, configure a reverse proxy or WAF rule to block redirects from /form/submit to untrusted hosts. Upgrading is the recommended path; most advisories have no official workaround.

How to detect it

If you cannot upgrade yet, focus monitoring on the endpoints named in these advisories: /s/ajax with lead:getLeadIdsByFieldValue, dashboard widget API requests, /api/campaigns/import, /api/stats/{table}, and asset creation through the API from accounts that do not normally use them. Review the web server's media directory for unexpected files after campaign imports. Mautic has not published specific indicators of compromise for these flaws.

Beyond the patch

These are holes in a self-managed marketing platform that may be reachable by more than just administrators, so the exposure is often the time between Mautic's release and your deployment. Managed Detection & Response (MDR) can catch the credential abuse and post-exploitation activity that RCE and SQL injection enable. Implementation & Assessment Services can verify the API exposure, permissions and web-server configuration before and after you upgrade.