CVE Vulnerability Catalog

A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API user with permission to create assets can register any file that is readable by the web server process as a Mautic asset. When the asset is published, its public download URL serves the contents of that file without authentication. This allows the attacker to read arbitrary files from the server, including Mautic configuration files containing the database password, secret key, and mail (SMTP) credentials, as well as system files and any other file readable by the web server user. Exposed credentials can be used to access the database or other connected services, and anyone with the public asset URL can retrieve the file contents.

A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization, so a user or integration able to write such a value can store a script payload that executes in another user's browser session, including an administrator's, when the contact detail page is opened.

An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before use in database queries; an authenticated API user can use blind SQL injection to read arbitrary data from the Mautic database, including contact data and user account data with password hashes.

A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before use in a database query; any authenticated Mautic user can exploit it regardless of role or permissions to read any data the Mautic database user can access, including user accounts with email addresses and password hashes, contact data, and campaign and email content.

An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths deserialize stored values without restricting which PHP classes may be instantiated instead of using Mautic's safe deserialization helper; an attacker able to store a crafted serialized value can cause arbitrary PHP objects to be instantiated, and combined with gadget chains in Mautic's dependencies could execute arbitrary code on the server and read, modify, or delete data.

A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox; an authenticated user with core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in arbitrary code execution with the privileges of the web server process.

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can place arbitrary files, including server-side scripts, in the web root, leading to remote code execution on servers such as the default Apache setup of the official Mautic Docker image.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected.

A vulnerability in the Bandit (Elixir) library allows an unauthenticated remote attacker to exhaust server memory via a fragmented WebSocket message made of many 1-byte continuation frames. The fragment reassembly does not limit the number of fragments, so memory usage can greatly exceed the configured limit.

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.

An inefficient algorithmic complexity vulnerability in Bandit's HTTP header integer parser allows an unauthenticated remote attacker to consume server CPU by sending a Content-Length value or Host/:authority port made of thousands of digits. The parser builds the number digit by digit without a length limit, resulting in quadratic time complexity.

In hackney (benoitc) from 2.0.0 before 4.9.0, improper neutralization of CRLF sequences in HTTP headers (HTTP Request/Response Splitting) exists in hackney_http_connect. After a 407 response from an HTTP CONNECT proxy, handle_proxy_auth/11 calls the caller's proxy_auth_fun and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it; a CR, LF, or NUL byte in that value adds header lines to the request sent to the proxy.

A wide range of Harbor versions allow SSRF via its webhook delivery component, which does not properly validate webhook target addresses, allowing use of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address; when a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target, and error response bodies are written to the webhook execution log readable by project members.

An improper cleanup on thrown exception vulnerability in Bandit's HTTP/2 handler allows an unauthenticated remote attacker to bypass per-connection resource limits by sending multiple frames in a single TCP write, one of which raises a stream error. The connection state rolls back, causing streams to be forgotten and limits to be exceeded.

An allocation of resources without limits or throttling vulnerability in Bandit's HTTP/1.1 chunked body reader allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The reader keeps every chunk as a separate term without limiting the number of chunks.

An allocation of resources without limits or throttling vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. The HPACK encoder table is resized to the client-advertised size without a server-side cap, causing O(N²) CPU cost for N responses.

This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could manipulate authentication requests and access APIs without a valid authenticated session. Successful exploitation could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, and access and modify sensitive information.

A vulnerability in the CreditNirvana Agentic AI Call Centre application due to a hardcoded static API key in the client-side JavaScript bundle. An unauthenticated remote attacker can download the JavaScript files, extract the API key, and make arbitrary API calls to retrieve call transcripts and recordings.

Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action.

An improper handling of highly compressed data (data amplification) vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores a large cookie value in the HPACK dynamic table and references it many times, causing excessive memory allocation.