Mautic: Stored Cross-Site Scripting in HTML-type contact fields
Summary
Mautic 7.0.0 up to 7.2.1 renders values of custom contact fields of type HTML on the contact detail view without output sanitization. A user or integration that can write a value to such a field, for example through contact editing, the contact API or a form submission mapped to the field, can store a script payload. When another user, including an administrator, opens the affected contact's detail page, the script runs in that user's active browser session, so an attacker could act on behalf of the victim, for example by creating administrator accounts, changing configuration or accessing contact and campaign data.
Affected
- Mautic (mautic/core, Composer) 7.0.0 up to 7.2.1
- Mautic 6.x, 5.x and 4.x are not affected according to the vendor
Fixed in
- Mautic 7.2.2
Workaround
- No official workaround is provided by the vendor.
- Restrict contact create and edit permissions and API access to trusted users.
- Do not map public form fields or publicly updatable settings to HTML-type contact fields.
Exploitation
- No evidence of exploitation in the wild found.
- Not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable no.
- No public proof of concept found in our searches.
Our recommendation
- Check whether the installation runs Mautic 7.0.0 to 7.2.1.
- Plan and perform an upgrade to Mautic 7.2.2 or later.
- Until the upgrade, restrict contact edit and API write access and remove public form mappings to HTML-type contact fields.
- Review existing HTML-type field values on contacts for script content.
- Inform administrators not to open contacts from untrusted sources before patching.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3295-vq3p-93rw github.com
- OpenCVE: CVE-2026-115193 app.opencve.io
- VulDB entry 426442 vuldb.com
- OffSeq Radar: CVE-2026-115193 radar.offseq.com
- Strix: CVE-2026-115193 www.strix.ai
- Mautic pull request 17934 (fix commit) github.com
- GitLab Advisory: CVE-2026-9811 (related Mautic 7 stored XSS) advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:57.
Original description (NVD)
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.