CVE-2026-115193 in Mautic
Summary
by MITRE • 10/26/2026
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Mautic 7 represents a critical stored Cross-Site Scripting flaw located within the rendering logic for custom contact fields designated with an HTML type. This security defect stems from a fundamental failure to implement output sanitization when displaying user-supplied content back to the browser. Unlike reflected XSS, where malicious scripts are executed immediately via a crafted link, this vulnerability allows attackers to persistently store payload data within the application's database through legitimate interaction points such as contact editing interfaces, API endpoints, or form submissions mapped to these specific fields. The persistence of the attack vector means that every subsequent access to the affected record by any user triggers the execution of the malicious code, creating a widespread and enduring threat surface.
From an operational perspective, the impact of this vulnerability is severe due to its potential for privilege escalation and data exfiltration. Because the script executes within the context of the victim's active browser session, it inherits all associated authentication tokens and permissions. An attacker can leverage this access to perform administrative actions on behalf of a privileged user, such as creating new administrator accounts with full system control or altering critical system configurations without authorization. Furthermore, the vulnerability enables unauthorized access to sensitive contact information and campaign data stored within the platform. This capability effectively compromises the confidentiality and integrity of the entire marketing automation infrastructure managed by Mautic, allowing for extensive surveillance of customer interactions and potential manipulation of business-critical campaigns.
In terms of industry classification standards, this flaw aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under the sub-category of Stored XSS where malicious scripts are permanently stored on target servers and executed when users retrieve data from the application. From a tactical standpoint within the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Collection via Browser Hijacking or Credential Access through Stealing Web Session Cookies if the script is designed to exfiltrate session tokens. It also supports Account Manipulation for persistence by allowing attackers to create backdoor accounts using administrative privileges obtained during the initial exploitation phase.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense requires implementing strict output encoding or sanitization libraries that adhere to context-aware rules, ensuring that any HTML content rendered in the browser is properly escaped to prevent script execution while preserving legitimate formatting where appropriate. Developers should also enforce Content Security Policy headers to restrict inline script execution, providing an additional layer of protection even if input validation fails. For administrators using affected versions, it is crucial to audit custom contact fields for malicious payloads and rotate all session cookies immediately after patching the software to invalidate any potentially compromised sessions. Regular security assessments and code reviews focusing on data flow from user inputs to browser outputs are essential to prevent similar vulnerabilities in future development cycles.