CVE-2025-9822 - CVE House
Back to Database
Status published Medium CVE-2025-9822

Secret data extraction via elfinder

Vulnerability Description

SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-9822

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • B0D0B0P0T
  • lenonleite
  • kuzmany

References

More from Mautic

View All →
CVE-2025-9824
User Enumeration via Response Timing
Medium 5.9
CVE-2025-9823
Reflected XSS in lead:addLeadTags - Quick Add
Medium 4.8
CVE-2025-9821
SSRF via webhook function
Low 2.7
CVE-2025-5257
Predictable Page Indexing Might Lead to Sensitive Data Exposure
Medium 6.5
CVE-2025-5256
Open Redirect vulnerability on user unlock path
Medium 5.4

Affected Vendor

Affected Software

Mautic
Vulnerable Versions:
>= 4.4.0, >= 5.0.0-alpha, >= 6.0.0-alpha

Timeline

Official Publish: September 3rd, 2025
Last Modified: September 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Weaknesses (CWE)

CWE-283

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.