IT SBIT Services
Schneeberger
DEEN
CVE tracker

Mautic Core: Insecure deserialization in segment filters and custom fields

CVE-2026-115190High 8.0

← All vulnerabilities

Summary

Mautic stores segment filter and custom field properties and several code paths deserialize these values without restricting the PHP classes that can be instantiated. An attacker who can store a crafted serialized value in these fields can trigger instantiation of arbitrary PHP objects when Mautic processes the data, for example during segment evaluation, contact export or custom field API requests. Combined with gadget chains in Mautic's dependencies, this could lead to code execution on the server and to reading, modifying or deleting contact data. Exploitation requires high privileges or existing write access to the affected stored data.

Affected

  • mautic/core >= 2.15.2 and < 5.2.12
  • mautic/core >= 6.0.0 and < 6.0.10
  • mautic/core >= 7.0.0 and < 7.2.0
  • Mautic 4.x: separate ELTS support, no free upstream fix known

Fixed in

  • 5.2.12
  • 6.0.10
  • 7.2.0 per CNA data; the vendor fix commit appears in the 7.2.2 release, so 7.2.2 or the newest 7.x is recommended until the vendor clarifies

Workaround

  • No official workarounds; the vendor advises restricting administrative access, including segment, custom field and API permissions, to trusted users
  • Ensure no untrusted party has write access to the Mautic database
  • These measures reduce the risk but do not fix the flaw

Exploitation

  • Not in CISA KEV
  • CISA SSVC: exploitation none, automatable no, technical impact total
  • OffSeq: not known to be exploited
  • No public proof of concept found; this is unknown rather than confirmed absent

Our recommendation

  • Inventory all Mautic instances, versions and forks, including 4.x
  • Upgrade to 7.2.2 (or newest 7.x), 6.0.10 or 5.2.12 after a full backup and staging test
  • Until patched, limit admin, segment, custom field and API accounts to a minimum of trusted users and check database write access
  • Review audit logs for unexpected changes to segment filters and custom field properties

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:14.

Original description (NVD)

An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of using Mautic's safe deserialization helper. An attacker who is able to store a crafted serialized value in these segment filter or custom field properties can cause arbitrary PHP objects to be instantiated when Mautic later processes the data, for example during segment evaluation, contact export, or custom field API requests. Combined with gadget chains available in Mautic's dependencies, this could allow an attacker to execute arbitrary code on the server, read, modify, or delete data stored in the Mautic instance, including contact data, and affect its availability. Exploitation requires high privileges or an existing ability to write to the affected stored data.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed