CVE-2025-13828
published 2025-12-02CVE-2025-13828: SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for…
PriorityP350critical9CVSS 4.0
AVNACLATPPRLUINVCHVIHVAHSCHSIHSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.23%
13.2th percentile
SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.
ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mautic | core | >= 4.0.0 < 4.4.18 | 4.4.18 |
| mautic | core | >= 5.0.0 < 5.2.9 | 5.2.9 |
| mautic | core | >= 6.0.0 < 6.0.7 | 6.0.7 |
| mautic | mautic | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
ghsa·2025-12-02
CVE-2025-13828 [CRITICAL] CWE-284 Mautic user without privileged access to the Marketplace can install and uninstall composer packages
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
### Summary
A non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.
### Impact
A low-privileged user of the platform can install malicious code to obtain higher privileges.
OSV
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
osv·2025-12-02
CVE-2025-13828 [CRITICAL] Mautic user without privileged access to the Marketplace can install and uninstall composer packages
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
### Summary
A non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.
### Impact
A low-privileged user of the platform can install malicious code to obtain higher privileges.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-02
Published