Mautic - Package Updates

Reply to Mautic - Package Updates on Wed, 08 Jul 2026 06:40:35 GMT

Package Updates — Wed, 08 Jul 2026 06:40:35 GMT

[6.1.2]

Update mautic to 7.1.3
Full Changelog
Fix category save crashing when apply button is disabled by @MoonFuji in #16180
Fix campaign restart issue by @escopecz in #16184
Fix infinite reschedule loop in ScheduledExecutioner::validateSchedule by @TowyTowy in #16066
Fix restarting campaign after republish on every cron job by @escopecz in #16183
Fix deleting a decision from a campaign causes an infinite email-resend loop via redirect_event_id by @hluchas in #16384
Re-enable Typography section and styling tools in GrapesJS builder by @patrykgruszka in #16098
Fix handling of text elements (headings, spans, paragraphs) in the GrapesJS + CKEditor integration. by @GoodPHP in #16058
Fix OAuth bearer auth for API v2 user-bound tokens by @escopecz in #16245
Do not process HEAD requests as unsubscribe requests by @Dominic-Mayers in #14967
Fix stale pending count from cache in email overview by @hluchas in #16442

Reply to Mautic - Package Updates on Fri, 29 May 2026 07:32:44 GMT

Package Updates — Fri, 29 May 2026 07:32:44 GMT

[6.1.1]

Update mautic to 7.1.2
Full Changelog
CVE-2026-4776: SQL Injection in API Contact Filtering
Advisory: GHSA-fcmw-wx57-9p75
CVE-2026-9557: SSRF in the Mautic Focus Component
Advisory: GHSA-jmv8-8j9j-rcpc
CVE-2026-9558: Server-Side Template Injection (SSTI) in Theme Templates
CVE-2026-9559: Path Traversal via Campaign Import
CVE-2026-9808: Authorization Bypass in API v2 Endpoints
CVE-2026-9809: Stored Cross-Site Scripting (XSS) in Projects Component
CVE-2026-9811: Stored Cross-Site Scripting (XSS) in Project Option Selector
Bumping CK editor libraries by @escopecz in #16074

Reply to Mautic - Package Updates on Wed, 13 May 2026 06:59:46 GMT

Package Updates — Wed, 13 May 2026 06:59:46 GMT

[6.1.0]

Update mautic to 7.1.1
Full Changelog
Fix include/exclude all operators for select fields by @patrykgruszka in #16012
If default_assetlimit is not set, use default_pagelimit parameter. by @biozshock in #16035
Contact timeline preview must use proper view. by @biozshock in #16034
Validate trusted hosts config variable. by @biozshock in #16006
Login throttling enabled by @fedys in #15651
S/MIME email signing by @escopecz in #15563
Optimistic locking for emails and pages by @fedys in #15774
Implement Message of the Day (MOTD) feature by @matbcvo in #15970
Prevent deletion of custom fields if they are in use by segments via API by @fedys in #15882
Prevent crash when campaign published time exceeds event interval by @escopecz in #15963

Reply to Mautic - Package Updates on Tue, 12 May 2026 01:01:20 GMT

Package Updates — Tue, 12 May 2026 01:01:20 GMT

[6.0.1]

Update mautic to 7.0.2
Full Changelog
Fix WebhookSubscriber "out of memory" issue. by @biozshock in #15881
Fix scheduling fields shown on edit page for segment emails by @matbcvo in #15914
Accept plugin updates for plugins where there are no Entity in the Pl by @biozshock in #15951
fix: Change detaching of leads and integration entities for Salesforce connection by @bastolen in #15948
Validate stronger the redirect URL for a form submit action by @kniziol in #15596
Fix regex operators on date fields causing DateTime parsing error by @matbcvo in #15986
Allow HTML in the Focus description field. by @biozshock in #16007
Fix removing filters from Email dynamic content. by @biozshock in #15953
https://github.com/mautic/mautic/security/advisories/GHSA-r5j5-q42h-fc93
Fix save DWC form while WYSIWYG is in source code mode by @patrykgruszka in #15824

Reply to Mautic - Package Updates on Mon, 11 May 2026 10:21:06 GMT

Package Updates — Mon, 11 May 2026 10:21:06 GMT

[6.0.0]

Update mautic to 7.0.0
Full Changelog
This app package requires Cloudron 9.2 which brings MySQL 8.4
Remove support for updating Mautic via the user interface by @matbcvo in #14689
Deprecating End of Life database versions, add support for more database versions by @mollux in #14836
Drop support for PHP 8.1 by @matbcvo in #14653
Removing the API limiter as the library is not maintained anymore by @escopecz in #14876
Removing support for AMQP queues by @escopecz in #14883
Upgrading to Symfony 7 by @escopecz in #14887
Remove Identify visitor by tracking url configuration setting by @kuzmany in #14974
Campaign import/export process by @levente999 in #14504 - this feature was funded by the NLNet Foundation.
Schedule sending for emails by @kuzmany in #14254
Projects - new way of grouping entities by @escopecz in #15002

Reply to Mautic - Package Updates on Fri, 27 Feb 2026 02:59:16 GMT

Package Updates — Fri, 27 Feb 2026 02:59:16 GMT

[5.1.5]

Update mautic to 6.0.8
Full Changelog
This release addresses one security issue. Please update at your earliest convenience after taking a backup and ensuring that it's working.
https://github.com/mautic/mautic/security/advisories/GHSA-r5j5-q42h-fc93
Update Composer development dependency phpunit/phpunit to fix CVE-2026-24765 #15817 by @escopecz

Reply to Mautic - Package Updates on Wed, 03 Dec 2025 08:19:45 GMT

Package Updates — Wed, 03 Dec 2025 08:19:45 GMT

[5.1.4]

Update mautic to 6.0.7
Full Changelog
This release addresses several security issues. Please update at your earliest convenience after taking a backup and ensuring that it's working.
https://github.com/mautic/mautic/security/advisories/GHSA-3fq7-c5m8-g86x - CVE-2025-13828 - Fixed privilege escalation vulnerability in Marketplace - Reported and fixed by @driskell, reviewed by @escopecz and @patrykgruszka.
https://github.com/mautic/mautic/security/advisories/GHSA-5xw2-57jx-pgjp - CVE-2025-13827 - Fixed file upload restriction bypass in GrapesJsBuilder - Reported and fixed by @driskell, reviewed by @escopecz and @patrykgruszka.
Update dependencies for M6 by @patrykgruszka in #15666
Bump guzzlehttp/oauth-subscriber to 0.8.1by @patrykgruszka in #15678

Reply to Mautic - Package Updates on Mon, 29 Sep 2025 14:31:17 GMT

Package Updates — Mon, 29 Sep 2025 14:31:17 GMT

[5.1.3]

Update mautic to 6.0.6
Full Changelog
Number field seems to offer help but there are no tooltips showing. by @biozshock in #15308
Fix form edit error with no group "adjust contact's point" action by @kou in #15452
fix(Form): Correct key existence check in FieldType by @shinde-rahul in #15363
Test to confirm empty values are applied to select and multiselect fields by @biozshock in #15358

Reply to Mautic - Package Updates on Thu, 04 Sep 2025 06:10:32 GMT

Package Updates — Thu, 04 Sep 2025 06:10:32 GMT

[5.1.2]

Update mautic to 6.0.5
Full Changelog
This release addresses several security issues. Please update at your earliest convenience after taking a backup and ensuring that it's working.
https://www.cve.org/CVERecord?id=CVE-2025-9821 - SSRF via webhook function - Reported by @asesidaa and fixed by @patrykgruszka and tested/reviewed by @kuzmany in https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69
https://www.cve.org/CVERecord?id=CVE-2025-9822 - Secret data extraction via elfinder - Reported by @B0D0B0P0T and fixed by @lenonleite and tested/reviewed by @kuzmany in https://github.com/mautic/mautic/security/advisories/GHSA-438m-6mhw-hq5w
https://www.cve.org/CVERecord?id=CVE-2025-9824 - User Enumeration via Response Timing - Reported by @Vautia and fixed by @nick-vanpraet and tested/reviewed by @kuzmany in https://github.com/mautic/mautic/security/advisories/GHSA-3ggv-qwcp-j6xg
https://www.cve.org/CVERecord?id=CVE-2025-9823 - Reflected XSS in lead:addLeadTags - Quick Add - Reported and fixed by @nmmorette and tested/reviewed by @kuzmany and @patrykgruszka in https://github.com/mautic/mautic/security/advisories/GHSA-9v8p-m85m-f7mm
DPMMA-2974 Fix Email chart stats for unsubscribed and bounced recipients by @patrykgruszka in #15315
DPMMA-3186 Fix IMAP\Connection is already closed by @patrykgruszka in #15364
Remove migration Version20230522141144 [6.0] by @matbcvo in #15385

Reply to Mautic - Package Updates on Thu, 07 Aug 2025 11:12:36 GMT

Package Updates — Thu, 07 Aug 2025 11:12:36 GMT

[5.1.1]

Update mautic to 6.0.4
Full Changelog
Preserve selected company when contact has more than 100 companies in the list by @patrykgruszka in https://github.com/mautic/mautic/pull/15232
Fix incorrectly encoded string value constants for ANSI SQL compatibility (6.x) by @notz in https://github.com/mautic/mautic/pull/15324
Fix issue with read/write replicas by replacing improper executeQuery usage with executeStatement for data modification queries by @patrykgruszka

Reply to Mautic - Package Updates on Wed, 30 Jul 2025 10:20:36 GMT

Package Updates — Wed, 30 Jul 2025 10:20:36 GMT

[5.1.0]

checklist added to manifest

Reply to Mautic - Package Updates on Tue, 01 Jul 2025 07:11:52 GMT

Package Updates — Tue, 01 Jul 2025 07:11:52 GMT

[5.0.3]

Update mautic to 6.0.3
Full Changelog
Fix dynamic content token replacement for external plugins by @biozshock in https://github.com/mautic/mautic/pull/14599
Fix API bulk edit processing same contact multiple times by @biozshock in https://github.com/mautic/mautic/pull/14928
Fix: Unable to upload assets with non-default file extensions by @andersonjeccel in https://github.com/mautic/mautic/pull/15111
DPMMA-1020 Fix search email with special characters in campaign action by @patrykgruszka in https://github.com/mautic/mautic/pull/10306
Fix campaign source widget text overflow handling by @kuzmany in https://github.com/mautic/mautic/pull/15055
FIX: Removes onConfigSave which invokes htmlspecialchars and escapes tracking script by @putzwasser in https://github.com/mautic/mautic/pull/13859
Fix custom field duplication when cloning contacts by @Hugo-Prossaird in https://github.com/mautic/mautic/pull/14780
Fix refetchEntity call timing after Lead instance check by @kuzmany in https://github.com/mautic/mautic/pull/15051
Fix error when saving contacts without points available by @npracht in https://github.com/mautic/mautic/pull/14714
Fix: Pagination is now working on the Audit Log tab of a contact by @driskell in https://github.com/mautic/mautic/pull/15086

Reply to Mautic - Package Updates on Thu, 29 May 2025 07:40:51 GMT

Package Updates — Thu, 29 May 2025 07:40:51 GMT

[5.0.2]

Update mautic to 6.0.2
Full Changelog
CVE-2025-5257 - Predictable Page Indexing Might Lead to Sensitive Data Exposure - Reported and fixed by @lenonleite and tested/reviewed by @escopecz and @kuzmany in https://github.com/mautic/mautic/security/advisories/GHSA-cqx4-9vqf-q3m8
CVE-2024-47056 - Mautic does not shield .env files from web traffic - Reported by @r3ky, analyzed by @lenonleite fixed by @nick-vanpraet and tested/reviewed by @patrykgruszka in https://github.com/mautic/mautic/security/advisories/GHSA-h2wg-v8wg-jhxh
CVE-2024-47057 - User name enumeration possible due to response time difference on password reset form - Reported and fixed by @tomekkowalczyk and reviewed by @patrykgruszka and @nick-vanpraet in https://github.com/mautic/mautic/security/advisories/GHSA-424x-cxvh-wq9p
CVE-2024-47055 - Segment cloning doesn't have a proper permission check - Reported and fixed by @abhisekmazumdar and @nick-vanpraet and tested/reviewed by @patrykgruszka in https://github.com/mautic/mautic/security/advisories/GHSA-vph5-ghq3-q782
CVE-2025-5256 - Open Redirect vulnerability on user unlock path - Reported and fixed by @tomekkowalczyk, tested/reviewed by @patrykgruszka and @nick-vanpraet in https://github.com/mautic/mautic/security/advisories/GHSA-6vx9-9r2g-8373
fix #14449: Dynamic Content in emails - not all variants visible in editor by @Krishu0765 in https://github.com/mautic/mautic/pull/14966

Reply to Mautic - Package Updates on Tue, 06 May 2025 14:33:42 GMT

Package Updates — Tue, 06 May 2025 14:33:42 GMT

[5.0.1]

Update mautic to 6.0.1
Full Changelog
Fix #14804: Hamburger menu issue on mobile by @pelbox in https://github.com/mautic/mautic/pull/14886
Fix #14457: Contact names with ampersands not showing in search by @goma101 in https://github.com/mautic/mautic/pull/14818
Fix #14240: Blank link shown in theme actions dropdown by @pedroasgomes in https://github.com/mautic/mautic/pull/14833
Fix: More trust settings: shows labels without inputs by @Krishu0765 in https://github.com/mautic/mautic/pull/14934
Fix SMS duplicate send by @kuzmany in https://github.com/mautic/mautic/pull/14874
Fixing migrations' preup checks by @escopecz in https://github.com/mautic/mautic/pull/14824
Add migration preup checks by @matbcvo in https://github.com/mautic/mautic/pull/14852
Allow more time window to make test valid. by @biozshock in https://github.com/mautic/mautic/pull/14918

Reply to Mautic - Package Updates on Tue, 15 Apr 2025 09:18:24 GMT

Package Updates — Tue, 15 Apr 2025 09:18:24 GMT

[5.0.0]

This is a major version update. Make sure all used plugins are compatible first.
Update mautic to 6.0.0
Full Changelog
Remove deprecated GenericPointSettingsType for M6 by @putzwasser in #13904
Removing the Gated Video feature by @escopecz in #14284
Use the new Symfony authenticator system. by @biozshock in #14219
[UI] Remove Froala styles by @andersonjeccel in #14271
Upgrading Mautic to Symfony 6 by @escopecz in #13962
[UI] Remove Font Awesome by @andersonjeccel in #14265
Removing the legacy builder by @escopecz in #14450
Removed MauticFactory::getDatabase. by @biozshock in #14418
Removed MauticFactory::getIpAddressFromRequest and MauticFactory::getDate. by @biozshock in #14564
Removed MauticFactory::getParameter. by @biozshock in #14565

Reply to Mautic - Package Updates on Tue, 25 Mar 2025 07:01:23 GMT

Package Updates — Tue, 25 Mar 2025 07:01:23 GMT

[4.5.0]

Update base image to 5.0.0
Update PHP to 8.3

Reply to Mautic - Package Updates on Tue, 25 Mar 2025 06:43:40 GMT

Package Updates — Tue, 25 Mar 2025 06:43:40 GMT

[4.4.4]

Update mautic to 5.2.4
Full Changelog
Fixing a 500 error when an asset was not found by @escopecz in https://github.com/mautic/mautic/pull/14663
DPMMA-3039 Company lookup limit by @patrykgruszka in https://github.com/mautic/mautic/pull/14461
Change behaviour of group elements for lookup field type by @npracht in https://github.com/mautic/mautic/pull/14716
Fix of disabling the Dashboard widget cache by @JonasLudwig1998 in https://github.com/mautic/mautic/pull/14467
DPMMA-3033 Correct focus item script response codes and fix undefined Focus.iframe by @patrykgruszka in https://github.com/mautic/mautic/pull/14521
Fix wording and encoding issue in notifications by @npracht in https://github.com/mautic/mautic/pull/14711
Salesforce campaign segment filter select fixed by @npracht in https://github.com/mautic/mautic/pull/14712
DPMMA-3096 Fix report boolean fields by @patrykgruszka in https://github.com/mautic/mautic/pull/14782
Fix #13570 - incorrect banner when multiple theme deletion by @johbuch in https://github.com/mautic/mautic/pull/14092
Fix issue #14338 Custom HTML Content hidden when creating email in Code Mode by @laurielim in https://github.com/mautic/mautic/pull/14638

Reply to Mautic - Package Updates on Tue, 25 Feb 2025 12:17:21 GMT

Package Updates — Tue, 25 Feb 2025 12:17:21 GMT

[4.4.3]

Update mautic to 5.2.3
Full Changelog
CVE-2024-47053 - Improper Authorization in Reporting API - Reported by @putzwasser, fixed by @lenonleite and tested/reviwed by @escopecz and @patrykgruszka in https://github.com/mautic/mautic/security/advisories/GHSA-8xv7-g2q3-fqgc
CVE-2022-25773 - Relative Path Traversal in assets file upload - Reported by @majkelstick and @patrykgruszka, fixed by @patrykgruszka and tested/reviewed by @escopecz and @lenonleite in https://github.com/mautic/mautic/security/advisories/GHSA-4w2w-36vm-c8hf
CVE-2024-47051 - Remote Code Execution & File Deletion in Asset Uploads - Reported by @mallo-m, fixed by @lenonleite and tested/reviewed by @patrykgruszka in https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2
DPMMA-3031 Configurable email address length limit to prevent delivery issues by @patrykgruszka in https://github.com/mautic/mautic/pull/14577
Fixing the audit log widget when a contact is deleted by @escopecz in https://github.com/mautic/mautic/pull/14541
Fixing segment building with default timezone by @escopecz in https://github.com/mautic/mautic/pull/14549
Email click tracking fix, PHP warning fix by @escopecz in https://github.com/mautic/mautic/pull/14540
fix: Fix font selection in CKEditor not including fallback fonts in output by @driskell in https://github.com/mautic/mautic/pull/14539

Reply to Mautic - Package Updates on Wed, 29 Jan 2025 10:02:31 GMT

Package Updates — Wed, 29 Jan 2025 10:02:31 GMT

[4.4.2]

Update mautic to 5.2.2
Full Changelog
Add missing "isIndexed" and "charLegthLimit" fields to the API response of Contact Fields. by @biozshock in https://github.com/mautic/mautic/pull/14442
fix: Creating or updating a contact via the Rest API discards seconds for date time fields by @driskell in https://github.com/mautic/mautic/pull/14484
Fix FormSubscriberTest by @fedys in https://github.com/mautic/mautic/pull/14474
Update decision/action panel colors in campaign's builder by @Hugo-Prossaird in https://github.com/mautic/mautic/pull/14404
Fix template for Campaign Editor by @bastolen in https://github.com/mautic/mautic/pull/14491
DPMMA-3048 Fix campaign execution stuck due to incorrect lead detachment in membership change action by @patrykgruszka in https://github.com/mautic/mautic/pull/14497
Add allowed protocols for links in CK5, so people can add phone links by @LordRembo in ht
...

Reply to Mautic - Package Updates on Wed, 18 Dec 2024 06:58:28 GMT

Package Updates — Wed, 18 Dec 2024 06:58:28 GMT

[4.4.1]

Update mautic to 5.2.1
Full Changelog
[UI/UX] Search (almost) Everything by @andersonjeccel in https://github.com/mautic/mautic/pull/14353
Add support to check duplicates for api/companies/batch/new by @kuzmany in https://github.com/mautic/mautic/pull/12273
fix: [DPMMA-2945] use hex colors in ckeditor by @patrykgruszka in https://github.com/mautic/mautic/pull/14322
fix: delete emails deleting contacts by @andersonjeccel in https://github.com/mautic/mautic/pull/14335
fix: theme upload width by @andersonjeccel in https://github.com/mautic/mautic/pull/14334

Reply to Mautic - Package Updates on Tue, 03 Dec 2024 11:51:18 GMT

Package Updates — Tue, 03 Dec 2024 11:51:18 GMT

[4.4.0]

Update mautic to 5.2.0
Full Changelog
Optimizing contacts activity API (refactoring of MR-10237 for Mautic v5) by @Moongazer in https://github.com/mautic/mautic/pull/12305
Refactor DBAL execute method to executeQuery. by @biozshock in https://github.com/mautic/mautic/pull/14139
Using "anonymous: lazy" to make the firewall lazy is deprecated, use "anonymous: true" and "lazy: true" instead. by @biozshock in https://github.com/mautic/mautic/pull/14124
The "security.encoder_factory.generic" service is deprecated, use "scurity.password_hasher_factory" instead. by @biozshock in https://github.com/mautic/mautic/pull/14125
[UI] Refactor hardcoded buttons using Twig template by @andersonjeccel in https://github.com/mautic/mautic/pull/14233
[UX] Updating Blank theme to MJML by @andersonjeccel in https://github.com/mautic/mautic/pull/14255
Referencing controllers with a single colon is deprecated. by @biozshock in https://github.com/mautic/mautic/pull/14130
Update readme and devdocs link by @laurielim in https://github.com/mautic/mautic/pull/14207

Reply to Mautic - Package Updates on Thu, 19 Sep 2024 06:41:35 GMT

Package Updates — Thu, 19 Sep 2024 06:41:35 GMT

[4.3.2]

Update Mautic to 5.1.1
Full changelog
CVE-2022-25768 - Improper access control in UI upgrade process - Reported by @mollux, fixed by @mollux and tested/reviewed by @escopecz and @patrykgruszka in GHSA-x3jx-5w6m-q2fc.
CVE-2024-47058 - Cross-site Scripting (XSS) - stored (edit form) - reported by @MatisAct, fixed by @lenonleite and tested/reviewed by @escopecz and @avikarshasha in GHSA-xv68-rrmw-9xwf.
CVE-2024-47050 - Cross-site Scripting (XSS) in contact/company tracking - reported by @mqrtin, fixed by @patrykgruszka and tested/reviewed by @escopecz in GHSA-73gr-32wg-qhh7.
CVE-2021-27917 - Cross-site Scripting (XSS) in contact tracking and page hits report - reported by @patrykgruszka, fixed by @lenonleite and tested/reviewed by @escopecz and @lenonleite in GHSA-xpc5-rr39-v8v2.
CVE-2024-47059 - User enumeration through weak password login prompt - reported and fixed by @tomekkowalczyk and tested/reviewed by @escopecz and @patrykgruszka in GHSA-8vff-35qm-qjvv.
CVE-2022-25770 - Removal of upgrade.php file which can have insufficient authentication - reported and fixed by @mollux, tested/reviewed by @kuzmany, @escopecz and @patrykgruzska in GHSA-qf6m-6m4g-rmrc.

Reply to Mautic - Package Updates on Tue, 25 Jun 2024 11:29:07 GMT

girish — Tue, 25 Jun 2024 11:29:07 GMT

[4.3.1]

Fix issue where cron runtime dir was not created

Reply to Mautic - Package Updates on Fri, 14 Jun 2024 14:35:04 GMT

nebulon — Fri, 14 Jun 2024 14:35:04 GMT

[4.3.0]

Update Mautic to 5.1.0
Full changelog