CVE-2026-115193 Details
Description
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.
A stored Cross-Site Scripting (XSS) vulnerability has been identified in Mautic version 7. This issue arises in the contact detail view, where values of HTML-type custom contact fields are displayed without proper output sanitization. As a result, a user or integration that can write to such a field—through contact editing, the contact API, or mapped form submissions—can inject a script payload. When another user, including an administrator, views the affected contact's detail page, the injected script executes in their browser session. This could enable an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, modifying system configurations, or accessing contact and campaign data.
Users can upgrade to Mautic version 7.2.2 to address this vulnerability. For those unable to upgrade, it is recommended to restrict contact creation and editing permissions, limit API access to trusted users, and avoid mapping public form fields or settings to HTML-type contact fields.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mautic/mautic/security/advisories/GHSA-3295-vq3p-93rw | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mautic | >= 7.0.0, < 7.2.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |