CVE-2022-25769: Improper regex in htaccess file

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-18 · updated 2026-06-17
Weakness: CWE-1284

Description

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

Affected products

Mautic: before 3.3.5; from 4.0.0 before 4.2.0 — fixed in 3.3.5, 4.2.0

How to fix

Upgrade to a fixed version: Mautic 3.3.5, 4.2.0. Check the vendor advisory for mitigations.

References

https://github.com/mautic/mautic/security/advisories/GHSA-mj6m-246h-9w56
https://www.mautic.org/blog/community/mautic-4-2-one-small-step-mautic

Get alerted when CVE-2022-25769 or the next vulnerability affects your stack