CVE-2025-9821: Mautic Core SSRF Vulnerability via Webhook Function
Summary
CVE-2025-9821: Mautic vulnerable to SSRF via webhook function. Affects mautic/core across 3 version ranges.
>= 4.4.0, < 4.4.17
>= 5.0.0-alpha, < 5.2.8
>= 6.0.0-alpha, < 6.0.5
Fixed in 4.4.17, 5.2.8 or 6.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation platform that enables businesses to manage their marketing campaigns, track customer interactions, and automate various marketing tasks. It provides features such as email marketing, lead management, and campaign tracking. However, a vulnerability has been identified in the Mautic Core package that allows users with webhook permissions to exploit server-side request forgery (SSRF) through improperly validated webhook destinations.
Vulnerability Detail
The vulnerability arises from the lack of validation for the destination URL when sending webhooks. This oversight allows users with webhook permissions to craft requests that can bypass firewalls and interact with internal services. The potential ramifications include unauthorized access to sensitive internal resources, which could lead to data leakage or further exploitation of the system. This vulnerability is classified under CWE-918, indicating a failure to restrict access to sensitive resources.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.4.0, < 4.4.174.4.17composer require mautic/core:4.4.17 -
>= 5.0.0-alpha, < 5.2.85.2.8composer require mautic/core:5.2.8 -
>= 6.0.0-alpha, < 6.0.56.0.5composer require mautic/core:6.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict webhook permissions to trusted users only and monitor webhook logs closely for any suspicious activity. Additionally, consider implementing firewall rules to limit access to internal services from external requests.
Conclusion
The identified SSRF vulnerability in Mautic Core poses a risk to users with webhook permissions, allowing unauthorized access to internal services. It is crucial to update to the patched versions to mitigate this risk and implement additional security measures as necessary.
See every vulnerability recorded for mautic/core →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially exposing sensitive data.
Any user with webhook permissions in Mautic Core versions 4.4.0 to 4.4.16, 5.0.0-alpha to 5.2.7, and 6.0.0-alpha to 6.0.4 is affected by this vulnerability.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By analyzing your composer.lock file, it can alert you in real-time about any vulnerabilities, including this one.
The CVSS score for this vulnerability is 2.7, indicating a low severity level.
If immediate updates are not possible, implement strict access controls on webhook permissions and monitor for any unusual activity in your logs.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
