Mautic Composer Package Management Vulnerability Allowing Arbitrary Code Installation by Low-Privileged Users

A vulnerability exists in Mautic versions 4.0 and above, allowing non-privileged users to install and remove arbitrary Composer packages. This can be done even when the option to enable Composer-based updates is disabled. As a result, a low-privileged user could potentially install malicious code to gain higher privileges on the platform.

Impact

Exploitation of this vulnerability could lead to unauthorized installation of malicious code, which could be used to escalate privileges within the application.

Remediation

Users can upgrade to Mautic versions 4.4.18, 5.2.9, or 6.0.7 to address this vulnerability.