What’s Vulnerable › Vulnerabilities

CVE-2017-1000490

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-01-03 · updated 2026-06-17
• Weakness: CWE-22

Description

Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

Affected products

• Mautic: 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0 (+34)
• Mautic: 1.0.0, 1.2.0, 2.9.0, 2.9.2, 2.10.0, 2.11.0

References

• https://github.com/mautic/mautic/releases/tag/2.12.0
• https://github.com/mautic/mautic/releases/tag/2.12.0

Get alerted when CVE-2017-1000490 or the next vulnerability affects your stack