CVE-2025-13828 — Mautic user without privileged access to the Marketplace can install and uninstall composer packages

CVE-2025-13828

Mautic user without privileged access to the Marketplace can install and uninstall composer packages PUBLISHED

Description (CNA)

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.

Affected (CNA)

Vendor / product	Versions
Mautic / Mautic	affected <4.4.18, <5.2.9, <6.0.7

CWE

CWE-862

References

https://github.com/mautic/mautic/security/advisories/GHSA-3fq7-c5m8-g86x

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.