LoginSign Up
← Back to all sparks
M

Mautic

MKT AUTO
Velocity5.0

Open-source marketing automation platform for email, social, and lead management.

www.mautic.org ↗

Mautic patches remote code execution in campaign import across three supported branches.

marketing automationopen sourcesecurityemail marketingmulti-branch maintenance
◆Current state
Mautic, the open-source marketing automation platform, released 7.2.2, 6.0.10 and 5.2.12 on 26 October as security releases, including remote code execution through campaign import and a Twig sandbox escape in theme templates. September's 7.2.1 was a bug sweep after the 7.2.0 feature release that added transactional emails, A/B testing for segment emails and a Marketplace API.
◆Where it's heading
The project keeps three branches (5.x, 6.x, 7.x) under coordinated security maintenance, with fixes landing on all of them the same day. Feature work comes in larger minor releases, followed by point releases that fix campaigns, forms and the builder.
◆Prediction
Expect 7.3 release candidates next, given 7.2.0 followed a two-RC pattern, with 5.x and 6.x continuing to receive security-only releases.

◆Recent moves

  1. 19d ago

    Mautic 7.2.2 fixes remote code execution in campaign import

    Mautic 7.2.2 is a security release whose fixes include remote code execution through campaign import (CVE-2026-115188). The most serious of the three same-day releases.

    View source ↗
  2. 19d ago

    Mautic 6.0.10 security release fixes a Twig sandbox escape

    Mautic 6.0.10 ships the same security fixes on the 6.x line, including the Twig sandbox escape in theme templates.

    View source ↗
  3. 19d ago

    Mautic 5.2.12 security release fixes a Twig sandbox escape

    Mautic 5.2.12 is a security release on the 5.x line, including a fix for a Twig sandbox escape in theme templates (CVE-2026-115189). Operators are urged to update after a backup.

    View source ↗
  4. 1mo ago

    Mautic 7.2.1 fixes campaign timing and repeating events

    7.2.1 is a bug sweep after 7.2.0: campaign emails now arrive at local time for contacts ahead of UTC, scheduled events no longer repeat endlessly, and two forms from different instances can share a page. Stabilization of the feature release.

    View source ↗
  5. 2mo ago

    Mautic Community 7.2.0 Lynx Edition

    ⚡ SPARK

    Mautic 7.2.0 lands with truly transactional emails, A/B testing for segment emails, MMS with tokens, a Marketplace API with reviews and ratings, point insights, user invitations by email, bulk contact field operations, and an infinite campaign canvas. The single largest feature drop in this version cycle.

    View source ↗
  6. 3mo ago

    7.2.0-rc2

    Second release candidate for 7.2.0 — pre-release testing milestone, not for production use.

    View source ↗