Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115196

Quick assessment

Affected
CVE-2026-115196
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mautic 的公开表单提交端点（/form/submit）存在开放重定向漏洞。在表单提交后，应用程序会将访问者重定向到随提交请求提供的返回地址，且未验证该地址是否指向 Mautic 实例本身或其他可信主机。未认证的攻击者可利用此漏洞，将来自合法 Mautic 域名的访问者重定向至任意外部网站，例如模仿原始落地页的钓鱼页面，或分发恶意软件的网站。任何已发布表单的 Mautic 实例均受此影响。成功利用该漏洞需要受害者提交由攻击者预先构造的表单。

CVSS 5.4 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

I. Basic Information for CVE-2026-115196

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 1.0.0-beta ~ 5.2.12 -

II. Public POCs for CVE-2026-115196

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115196

请登录查看更多情报信息。

Other References for CVE-2026-115196 (1)

IV. Related Vulnerabilities

Same weakness: CWE-601