critical9.0
CVE-2025-13828
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
Impact
### Summary A non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ### Impact A low-privileged user of the platform can install malicious code to obtain higher privileges.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | mautic/core | >= 4.0.0, < 4.4.18 | 4.4.18 |