VULNERABILITY INTELLIGENCE
CVE-2025-13828
EPSS probability0.25%
CISA KEVNot currently listed
Published2025-12-02
Last modified2026-10-18
Description
SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.
Weakness classification
- security@mautic.org: CWE-862