CVE-2026-115190 Details
Description
An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of using Mautic's safe deserialization helper. An attacker who is able to store a crafted serialized value in these segment filter or custom field properties can cause arbitrary PHP objects to be instantiated when Mautic later processes the data, for example during segment evaluation, contact export, or custom field API requests. Combined with gadget chains available in Mautic's dependencies, this could allow an attacker to execute arbitrary code on the server, read, modify, or delete data stored in the Mautic instance, including contact data, and affect its availability. Exploitation requires high privileges or an existing ability to write to the affected stored data.
A vulnerability allowing insecure deserialization (PHP object injection) has been identified in Mautic versions 2.15.2 prior to 5.2.12, 6.0.0 prior to 6.0.10, and 7.0.0 prior to 7.2.0. This vulnerability arises in Mautic's processing of segment filters and custom field properties. Several code paths that retrieve these values from the database deserialize them without proper restrictions on which PHP classes can be instantiated, failing to utilize Mautic's safe deserialization helper. An attacker with the ability to write crafted serialized values into these segment filters or custom fields can manipulate Mautic into instantiating arbitrary PHP objects. This exploitation could occur during segment evaluations, contact exports, or custom field API requests. The vulnerability requires high privileges or an existing capability to modify the affected data.
Users can upgrade to Mautic versions 5.2.12, 6.0.10, or 7.2.0 to address this vulnerability. For those using Mautic 4, general security support is available through the Extended Long-Term Support (ELTS) program.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mautic/mautic/security/advisories/GHSA-5r63-8h35-j3mw | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mautic | >= 2.15.2, < 5.2.12 (semver) >= 6.0.0, < 6.0.10 (semver) >= 7.0.0, < 7.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |