CVE-2026-3105
High · 7.6CVSS
7.6
EPSS
0.4%
Published
Feb 24, 2026
CISA due date
—
The record
SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API. MitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1 or later. WorkaroundsNone. ReferencesIf you have any questions or comments about this advisory: Email us at security@mautic.org
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | mautic/core | 2.10.0 | 5.2.10 |
| Packagist | mautic/core | 6.0.0-alpha | 6.0.8 |
| Packagist | mautic/core | 7.0.0-alpha | 7.0.1 |
Related vulnerabilities
- GHSA-r5j5-q42h-fc93 Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting Same vulnerability
- CVE-2025-13828 SummaryA non privileged user can install and remove arbitrary packages via composer for a… Also affects mautic/core
- CVE-2026-87936 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89
- CVE-2026-87938 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89
- CVE-2026-114664 Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the… CWE-89
- CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. CWE-89
- CVE-2026-113406 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. CWE-89
- CVE-2026-113405 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. CWE-89