Read the docs
TI-2017-14699 Aliases CVE-2017-1000490GHSA-qpgw-2c72-4c89

Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user…

Priority LOW 32CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

Why it matters now

EPSS 0.01403 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed mautic/core (Packagist): 2.12.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—mautic/core (Packagist)1.0.0 to before 2.12.02.12.0Patch availableGHSA-qpgw-2c72-4c89
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • mautic/core (Packagist) Vendor— Affected 1.0.0 to before 2.12.0 Fixed in 2.12.0 Patch available GHSA-qpgw-2c72-4c89

CPE configurations NVD · 46

CPEVersionsRoleVendor
cpe:2.3:a:acquia:mautic:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.0.5:*:*:*:*:*:*:*1.0.5VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.1.3:*:*:*:*:*:*:*1.1.3VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.2.0:beta1:*:*:*:*:*:*1.2.0 beta1VulnerableAcquia
  • cpe:2.3:a:acquia:mautic:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.2.0:beta1:*:*:*:*:*:* Versions 1.2.0 beta1 Vulnerable ·Acquia
Show 36 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:acquia:mautic:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.2.3:*:*:*:*:*:*:*1.2.3VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableAcquia
cpe:2.3:a:acquia:mautic:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.5.1:*:*:*:*:*:*:*2.5.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.6.1:*:*:*:*:*:*:*2.6.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.8.0:*:*:*:*:*:*:*2.8.0VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.8.1:*:*:*:*:*:*:*2.8.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.8.2:*:*:*:*:*:*:*2.8.2VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.9.0:beta:*:*:*:*:*:*2.9.0 betaVulnerableAcquia
cpe:2.3:a:acquia:mautic:2.9.1:*:*:*:*:*:*:*2.9.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.10.0:beta:*:*:*:*:*:*2.10.0 betaVulnerableAcquia
cpe:2.3:a:acquia:mautic:2.10.1:*:*:*:*:*:*:*2.10.1VulnerableAcquia
cpe:2.3:a:acquia:mautic:2.11.0:beta:*:*:*:*:*:*2.11.0 betaVulnerableAcquia
cpe:2.3:a:mautic:mautic:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableMautic
cpe:2.3:a:mautic:mautic:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableMautic
cpe:2.3:a:mautic:mautic:2.9.0:*:*:*:*:*:*:*2.9.0VulnerableMautic
cpe:2.3:a:mautic:mautic:2.9.2:*:*:*:*:*:*:*2.9.2VulnerableMautic
cpe:2.3:a:mautic:mautic:2.10.0:*:*:*:*:*:*:*2.10.0VulnerableMautic
cpe:2.3:a:mautic:mautic:2.11.0:*:*:*:*:*:*:*2.11.0VulnerableMautic
  • cpe:2.3:a:acquia:mautic:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.8.1:*:*:*:*:*:*:* Versions 2.8.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.8.2:*:*:*:*:*:*:* Versions 2.8.2 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.9.0:beta:*:*:*:*:*:* Versions 2.9.0 beta Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.9.1:*:*:*:*:*:*:* Versions 2.9.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.10.0:beta:*:*:*:*:*:* Versions 2.10.0 beta Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.10.1:*:*:*:*:*:*:* Versions 2.10.1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:2.11.0:beta:*:*:*:*:*:* Versions 2.11.0 beta Vulnerable ·Acquia
  • cpe:2.3:a:mautic:mautic:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Mautic
  • cpe:2.3:a:mautic:mautic:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Mautic
  • cpe:2.3:a:mautic:mautic:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Mautic
  • cpe:2.3:a:mautic:mautic:2.9.2:*:*:*:*:*:*:* Versions 2.9.2 Vulnerable ·Mautic
  • cpe:2.3:a:mautic:mautic:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Mautic
  • cpe:2.3:a:mautic:mautic:2.11.0:*:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·Mautic

Remediation

  • Fix · GHSA-qpgw-2c72-4c89 mautic/core (Packagist) Fixed in 2.12.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-1000490
  2. 2026-10-03 Alias added: GHSA-qpgw-2c72-4c89

References

Exploit 1

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences