Mautic - Package Updates

Package Updates

[5.0.0]

This is a major version update. Make sure all used plugins are compatible first.
Update mautic to 6.0.0
Full Changelog
Remove deprecated GenericPointSettingsType for M6 by @putzwasser in #13904
Removing the Gated Video feature by @escopecz in #14284
Use the new Symfony authenticator system. by @biozshock in #14219
[UI] Remove Froala styles by @andersonjeccel in #14271
Upgrading Mautic to Symfony 6 by @escopecz in #13962
[UI] Remove Font Awesome by @andersonjeccel in #14265
Removing the legacy builder by @escopecz in #14450
Removed MauticFactory::getDatabase. by @biozshock in #14418
Removed MauticFactory::getIpAddressFromRequest and MauticFactory::getDate. by @biozshock in #14564
Removed MauticFactory::getParameter. by @biozshock in #14565

Package Updates

[5.0.1]

Package Updates

[5.0.2]

Update mautic to 6.0.2
Full Changelog
CVE-2025-5257 - Predictable Page Indexing Might Lead to Sensitive Data Exposure - Reported and fixed by @lenonleite and tested/reviewed by @escopecz and @kuzmany in https://github.com/mautic/mautic/security/advisories/GHSA-cqx4-9vqf-q3m8
CVE-2024-47056 - Mautic does not shield .env files from web traffic - Reported by @r3ky, analyzed by @lenonleite fixed by @nick-vanpraet and tested/reviewed by @patrykgruszka in https://github.com/mautic/mautic/security/advisories/GHSA-h2wg-v8wg-jhxh
CVE-2024-47057 - User name enumeration possible due to response time difference on password reset form - Reported and fixed by @tomekkowalczyk and reviewed by @patrykgruszka and @nick-vanpraet in https://github.com/mautic/mautic/security/advisories/GHSA-424x-cxvh-wq9p
CVE-2024-47055 - Segment cloning doesn't have a proper permission check - Reported and fixed by @abhisekmazumdar and @nick-vanpraet and tested/reviewed by @patrykgruszka in https://github.com/mautic/mautic/security/advisories/GHSA-vph5-ghq3-q782
CVE-2025-5256 - Open Redirect vulnerability on user unlock path - Reported and fixed by @tomekkowalczyk, tested/reviewed by @patrykgruszka and @nick-vanpraet in https://github.com/mautic/mautic/security/advisories/GHSA-6vx9-9r2g-8373
fix #14449: Dynamic Content in emails - not all variants visible in editor by @Krishu0765 in https://github.com/mautic/mautic/pull/14966

Package Updates

[5.0.3]

Update mautic to 6.0.3
Full Changelog
Fix dynamic content token replacement for external plugins by @biozshock in https://github.com/mautic/mautic/pull/14599
Fix API bulk edit processing same contact multiple times by @biozshock in https://github.com/mautic/mautic/pull/14928
Fix: Unable to upload assets with non-default file extensions by @andersonjeccel in https://github.com/mautic/mautic/pull/15111
DPMMA-1020 Fix search email with special characters in campaign action by @patrykgruszka in https://github.com/mautic/mautic/pull/10306
Fix campaign source widget text overflow handling by @kuzmany in https://github.com/mautic/mautic/pull/15055
FIX: Removes onConfigSave which invokes htmlspecialchars and escapes tracking script by @putzwasser in https://github.com/mautic/mautic/pull/13859
Fix custom field duplication when cloning contacts by @Hugo-Prossaird in https://github.com/mautic/mautic/pull/14780
Fix refetchEntity call timing after Lead instance check by @kuzmany in https://github.com/mautic/mautic/pull/15051
Fix error when saving contacts without points available by @npracht in https://github.com/mautic/mautic/pull/14714
Fix: Pagination is now working on the Audit Log tab of a contact by @driskell in https://github.com/mautic/mautic/pull/15086

Package Updates

[5.1.0]

Package Updates

[5.1.1]

Update mautic to 6.0.4
Full Changelog
Preserve selected company when contact has more than 100 companies in the list by @patrykgruszka in https://github.com/mautic/mautic/pull/15232
Fix incorrectly encoded string value constants for ANSI SQL compatibility (6.x) by @notz in https://github.com/mautic/mautic/pull/15324
Fix issue with read/write replicas by replacing improper executeQuery usage with executeStatement for data modification queries by @patrykgruszka

Package Updates

[5.1.2]

Update mautic to 6.0.5
Full Changelog
This release addresses several security issues. Please update at your earliest convenience after taking a backup and ensuring that it's working.
https://www.cve.org/CVERecord?id=CVE-2025-9821 - SSRF via webhook function - Reported by @asesidaa and fixed by @patrykgruszka and tested/reviewed by @kuzmany in https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69
https://www.cve.org/CVERecord?id=CVE-2025-9822 - Secret data extraction via elfinder - Reported by @B0D0B0P0T and fixed by @lenonleite and tested/reviewed by @kuzmany in https://github.com/mautic/mautic/security/advisories/GHSA-438m-6mhw-hq5w
https://www.cve.org/CVERecord?id=CVE-2025-9824 - User Enumeration via Response Timing - Reported by @Vautia and fixed by @nick-vanpraet and tested/reviewed by @kuzmany in https://github.com/mautic/mautic/security/advisories/GHSA-3ggv-qwcp-j6xg
https://www.cve.org/CVERecord?id=CVE-2025-9823 - Reflected XSS in lead:addLeadTags - Quick Add - Reported and fixed by @nmmorette and tested/reviewed by @kuzmany and @patrykgruszka in https://github.com/mautic/mautic/security/advisories/GHSA-9v8p-m85m-f7mm
DPMMA-2974 Fix Email chart stats for unsubscribed and bounced recipients by @patrykgruszka in #15315
DPMMA-3186 Fix IMAP\Connection is already closed by @patrykgruszka in #15364
Remove migration Version20230522141144 [6.0] by @matbcvo in #15385

Package Updates

[5.1.3]

Update mautic to 6.0.6
Full Changelog
Number field seems to offer help but there are no tooltips showing. by @biozshock in #15308
Fix form edit error with no group "adjust contact's point" action by @kou in #15452
fix(Form): Correct key existence check in FieldType by @shinde-rahul in #15363
Test to confirm empty values are applied to select and multiselect fields by @biozshock in #15358

Package Updates

[5.1.4]

Update mautic to 6.0.7
Full Changelog
This release addresses several security issues. Please update at your earliest convenience after taking a backup and ensuring that it's working.
https://github.com/mautic/mautic/security/advisories/GHSA-3fq7-c5m8-g86x - CVE-2025-13828 - Fixed privilege escalation vulnerability in Marketplace - Reported and fixed by @driskell, reviewed by @escopecz and @patrykgruszka.
https://github.com/mautic/mautic/security/advisories/GHSA-5xw2-57jx-pgjp - CVE-2025-13827 - Fixed file upload restriction bypass in GrapesJsBuilder - Reported and fixed by @driskell, reviewed by @escopecz and @patrykgruszka.
Update dependencies for M6 by @patrykgruszka in #15666
Bump guzzlehttp/oauth-subscriber to 0.8.1by @patrykgruszka in #15678

Package Updates

[5.1.5]

Update mautic to 6.0.8
Full Changelog
This release addresses one security issue. Please update at your earliest convenience after taking a backup and ensuring that it's working.
https://github.com/mautic/mautic/security/advisories/GHSA-r5j5-q42h-fc93
Update Composer development dependency phpunit/phpunit to fix CVE-2026-24765 #15817 by @escopecz

Cloudron Forum