Open-source package vulnerability · Composer (PHP)

CVE-2025-13828: Mautic user without privileged access to the Marketplace can install and uninstall composer packages

criticalCVSS 4.0 9.0GHSA-3fq7-c5m8-g86x

Summary A non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. Impact A low-privileged user of the platform can install malicious code to obtain higher privileges.

Published Dec 2, 2025

Affected packages

mautic/core

Ecosystem: Composer (PHP)
Affected: >= 4.0.0, < 4.4.18
Fixed in: 4.4.18
Check: composer show mautic/core

mautic/core

Ecosystem: Composer (PHP)
Affected: >= 5.0.0, < 5.2.9
Fixed in: 5.2.9
Check: composer show mautic/core

mautic/core

Ecosystem: Composer (PHP)
Affected: >= 6.0.0, < 6.0.7
Fixed in: 6.0.7
Check: composer show mautic/core

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

A non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.

Impact

A low-privileged user of the platform can install malicious code to obtain higher privileges.

Credited to driskell, escopecz, patrykgruszka.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Composer (PHP) vulnerabilities

All Composer (PHP) entries