Mautic Files

Announcing Mautic 7.2.2: Alsciaukat Edition

Security Release

This release addresses several security vulnerabilities. We strongly advise updating your installation at your earliest convenience after performing a full backup and testing the upgrade in a staging environment.

🔒 Security Fixes

• CVE-2026-115188: Remote Code Execution in Campaign Import
• Attribution: Reported by @m0xath, @iys8, @DavidCarliez, @Forrof, @sdrk3nD, @Hama1cco, @4n86rakam1, and @calbebop. Fixed by @patrykgruszka. Reviewed by @escopecz.

• Advisory: GHSA-mxjf-pghx-h299

• CVE-2026-115189: Twig Sandbox Escape in Theme Templates

• Attribution: Reported by @amagesh1, @manus-use, @sec-reex, @prakhar0x01, @lostfany, @trungpv19, @SRTSubmersionAI, @CyberKareem, @m0xath, @Forrof, @cxcsec, @lucasdodgson, @FlowOverFail, @tal2k9dev-star, and @tlavi00. Analysis by @Den1al. Fixed by @amagesh1. Reviewed by @escopecz and @patrykgruszka.

• Advisory: GHSA-h7pm-79gc-8867

• CVE-2026-115191: SQL Injection in Contact Lookup AJAX Endpoint

• Attribution: Reported by @cuongkt194, @tiencong-98, @bharatdevasani, @pavelkohout396, @blvck-ltr, @Haxset, @cy3erm, @Infinit3i, @AdamKorcz, and @manus-pi. Fixed by @cuongkt194. Reviewed by @escopecz and @patrykgruszka.

• Advisory: GHSA-fj8v-c9c3-7q26

• CVE-2026-115192: SQL Injection in Dashboard Widget API

• Attribution: Reported by @pavelkohout396, @skeletonsec, @abdugafforov-bobur, and @AdamKorcz. Coordinated by @wsparks-vc. Fixed by @abdugafforov-bobur. Reviewed by @escopecz and @patrykgruszka.

• Advisory: GHSA-qpmx-7pq3-5q2v

• CVE-2026-115193: Stored Cross-Site Scripting (XSS) in HTML-type Custom Contact Field on Contact Detail View

• Attribution: Reported by @EndlssNightmare, @im-rootkid, @m0xath, @EvidentObscurity, @tinyb0y, and @wewea00. Fixed by @m0xath. Reviewed by @escopecz and @patrykgruszka.

• Advisory: GHSA-3295-vq3p-93rw

• CVE-2026-115194: Arbitrary File Read via Path Traversal in Asset API

• Attribution: Reported by @cristibtz, @louissanchez-vokecyber, @pavelkohout396, @toyakula, and @Forrof. Fixed by @cristibtz. Reviewed by @escopecz and @patrykgruszka.

• Advisory: GHSA-wfhm-289v-79vp

• CVE-2026-115195: Broken Access Control in Stats API

• Attribution: Reported by @abdugafforov-bobur and @joostgrunwald. Coordinated by @wsparks-vc. Fixed by @abdugafforov-bobur. Reviewed by @escopecz and @patrykgruszka.

• Advisory: GHSA-7j28-9rg4-wg63

• CVE-2026-115196: Open Redirect in Form Submission

• Attribution: Reported by @geo-chen, @kodareef5, @ZeroXJacks, and @sun1024. Fixed by @escopecz. Reviewed by @patrykgruszka.
• Advisory: GHSA-5mm3-3g7p-9868

What's Changed

🐛 Bugs

:file_folder: Assets

• Downloaded assets now keep their original filename instead of an internal ID by @patrykgruszka in https://github.com/mautic/mautic/pull/17526

:technologist: Automated tests

• Remove test code that could never run after an expected exception by @dylanpulver in https://github.com/mautic/mautic/pull/17615

:rocket: Campaigns

• Campaign screens now consistently say "activate" and "reactivate" instead of "publish" and "republish" by @AlexanderZlobinM1 in https://github.com/mautic/mautic/pull/17678

:busts_in_silhouette: Contacts

• Frequency settings in the preference center now render and save correctly by @AlexanderZlobinM1 in https://github.com/mautic/mautic/pull/17669

:robot: DevOps

• Saving an email no longer fails on production installs because of a missing component by @AlexanderZlobinM1 in https://github.com/mautic/mautic/pull/17592
• Release packages now include the component needed for email link validation by @gcomneno in https://github.com/mautic/mautic/pull/17616
• Remove the broken development package builder and outdated packaging exclusions by @SirLouen in https://github.com/mautic/mautic/pull/17832

:arrows_counterclockwise: Dynamic content

• Dynamic web content tokens in links, images and form actions are replaced safely again on systems with newer libxml by @escopecz in https://github.com/mautic/mautic/pull/17913

:love_letter: Email

• Discarding an email draft no longer clears fields of the saved email by @gcomneno in https://github.com/mautic/mautic/pull/17653
• Failed sends in a partially successful batch are now recorded instead of silently ignored by @escopecz in https://github.com/mautic/mautic/pull/17666
• Updating an email through the API no longer removes its dynamic content when the request leaves it out by @introfini in https://github.com/mautic/mautic/pull/17851
• A/B test winners can be selected manually again for emails and landing pages by @AlexanderZlobinM1 in https://github.com/mautic/mautic/pull/17303

:clipboard: Forms

• The form editor no longer breaks when a free HTML or free text field contains a nested form tag by @AlexanderZlobinM1 in https://github.com/mautic/mautic/pull/17796

:grapes: GrapesJS Builder

• Composer-based installations now include the prebuilt drag-and-drop builder files by @patrykgruszka in https://github.com/mautic/mautic/pull/17831
• After a validation error, the builder now explains that your content is kept but not saved yet by @gcomneno in https://github.com/mautic/mautic/pull/17604

⇅ Import/export

• The campaign import screen now refers to campaigns instead of contacts by @AlexanderZlobinM1 in https://github.com/mautic/mautic/pull/17610

:seedling: Plugin support

• CRM integrations no longer lose their plugin settings while pulling contact data by @techsurrusr in https://github.com/mautic/mautic/pull/17815

:mag: Search

• Searching with several spaces between words no longer causes an error that keeps the contact list broken by @patrykgruszka in https://github.com/mautic/mautic/pull/17857

:mag_right: Themes

• Uploaded themes can use safe Twig filters such as sort, map and filter again by @AlexanderZlobinM1 in https://github.com/mautic/mautic/pull/17620
• Outdated styles from an earlier version no longer override the current design after an upgrade by @gcomneno in https://github.com/mautic/mautic/pull/17597

:art: User Experience / User Interface

• Dates and times now display correctly after a user changes their timezone by @AlexanderZlobinM1 in https://github.com/mautic/mautic/pull/17627
• Editing a user no longer fails when old activity entries point to deleted users or roles by @AlexanderZlobinM1 in https://github.com/mautic/mautic/pull/17609
• Forms for new items, such as a new segment, now always open on their first tab by @JonasLudwig1998 in https://github.com/mautic/mautic/pull/17680

New Contributors

• @gcomneno made their first contribution in https://github.com/mautic/mautic/pull/17616
• @techsurrusr made their first contribution in https://github.com/mautic/mautic/pull/17815
• @SirLouen made their first contribution in https://github.com/mautic/mautic/pull/17832

💡 Release Team & Sponsors

This release was made possible through the dedicated efforts of our community and supporters:

• Release Leader: @patrykgruszka
• Release Support: @escopecz, @matbcvo
• Sponsor: Special thanks to @leuchtfeuer for sponsoring this security release.

SHA1(7.2.2.zip)= [4d0281] SHA1(7.2.2-update.zip)= [b4f7e4]