Mautic Community 5.2.12

Security Release

This release addresses several security vulnerabilities. We strongly advise updating your installation at your earliest convenience after performing a full backup and testing the upgrade in a staging environment.

🔒 Security Fixes

• CVE-2026-115189: Twig Sandbox Escape in Theme Templates

  • Attribution: Reported by @amagesh1, @manus-use, @sec-reex, @prakhar0x01, @lostfany, @trungpv19, @SRTSubmersionAI, @CyberKareem, @m0xath, @Forrof, @cxcsec, @lucasdodgson, @FlowOverFail, @tal2k9dev-star, and @tlavi00. Analysis by @Den1al. Fixed by @amagesh1. Reviewed by @escopecz and @patrykgruszka.
  • Advisory: GHSA-h7pm-79gc-8867

• CVE-2026-115190: Insecure Deserialization in Segment Filters and Custom Fields

  • Attribution: Reported by @tikket1. Fixed by @patrykgruszka. Reviewed by @escopecz.
  • Advisory: GHSA-5r63-8h35-j3mw

• CVE-2026-115191: SQL Injection in Contact Lookup AJAX Endpoint

  • Attribution: Reported by @cuongkt194, @tiencong-98, @bharatdevasani, @pavelkohout396, @blvck-ltr, @Haxset, @cy3erm, @Infinit3i, @AdamKorcz, and @manus-pi. Fixed by @cuongkt194. Reviewed by @escopecz and @patrykgruszka.
  • Advisory: GHSA-fj8v-c9c3-7q26

• CVE-2026-115192: SQL Injection in Dashboard Widget API

  • Attribution: Reported by @pavelkohout396, @skeletonsec, @abdugafforov-bobur, and @AdamKorcz. Coordinated by @wsparks-vc. Fixed by @abdugafforov-bobur. Reviewed by @escopecz and @patrykgruszka.
  • Advisory: GHSA-qpmx-7pq3-5q2v

• CVE-2026-115194: Arbitrary File Read via Path Traversal in Asset API

  • Attribution: Reported by @cristibtz, @louissanchez-vokecyber, @pavelkohout396, @toyakula, and @Forrof. Fixed by @cristibtz. Reviewed by @escopecz and @patrykgruszka.
  • Advisory: GHSA-wfhm-289v-79vp

• CVE-2026-115195: Broken Access Control in Stats API

  • Attribution: Reported by @abdugafforov-bobur and @joostgrunwald. Coordinated by @wsparks-vc. Fixed by @abdugafforov-bobur. Reviewed by @escopecz and @patrykgruszka.
  • Advisory: GHSA-7j28-9rg4-wg63

• CVE-2026-115196: Open Redirect in Form Submission

  • Attribution: Reported by @geo-chen, @kodareef5, @ZeroXJacks, and @sun1024. Fixed by @escopecz. Reviewed by @patrykgruszka.
  • Advisory: GHSA-5mm3-3g7p-9868

✨ Features and enhancements

• A new menu item to support Mautic by @escopecz in #17931

💡 Release Team & Sponsors

This release was made possible through the dedicated efforts of our community and supporters:

• Release Leader: @patrykgruszka
• Release Support: @escopecz, @matbcvo
• Sponsor: Special thanks to @Leuchtfeuer for sponsoring this security release.

SHA1(5.2.12.zip)= 92b7d38b5330e04e041369c2ebccea8cea35f185
SHA1(5.2.12-update.zip)= b2815f4e51a20de098c99deed560df1f65ade29d