CVE-2026-9809

CVE-2026-9809 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting Mautic 7 (versions 7.0.0 through 7.1.1). The flaw exists in the Projects component, where project names are displayed as tags and hover popovers on administrative pages (such as campaigns, emails, and forms) without proper output sanitization. An authenticated user with permission to create or edit projects can store malicious HTML/JavaScript in a project name. When an administrator later views an entity associated with that project and hovers over its tag, the malicious script executes in the administrator's browser.

Affected Software

Vulnerability Type

Root Cause

The application stores project names provided by authenticated users. Later, when project tags and popover content are rendered on administrative pages, the stored value is inserted into the HTML without proper output encoding or sanitization.

Conceptually:

User creates project
        │
        ▼
Project name stored in database
        │
        ▼
Administrator opens Campaign / Email / Form
        │
        ▼
Project tag & popover rendered
        │
        ▼
Project name inserted into HTML without sanitization
        │
        ▼
Browser executes embedded JavaScript

Instead of treating the project name as plain text, the browser interprets it as HTML, allowing embedded JavaScript to execute.

Attack Flow

Attacker
    │
    ▼
Creates a project with a malicious project name
    │
    ▼
Payload stored in database
    │
    ▼
Administrator views Campaign / Email / Form
    │
    ▼
Administrator hovers over the project tag
    │
    ▼
Popover renders unsanitized project name
    │
    ▼
Browser executes JavaScript
    │
    ▼
Actions performed with administrator's privileges

Attack Scenario

Suppose an authenticated user creates a project whose name contains HTML instead of ordinary text.

The project is successfully saved because the application does not sanitize the project name on input.

Later, an administrator opens a campaign associated with that project. When the administrator hovers over the project's tag, the application generates a popover using the stored project name. Since the content is inserted into the page without proper output encoding, the browser interprets it as HTML rather than plain text, causing the embedded JavaScript to execute in the administrator's session.

Impact

Successful exploitation may allow an attacker to:

• Execute arbitrary JavaScript in an administrator's browser.
• Perform actions using the administrator's session.
• Modify application settings.
• Access sensitive administrative data.
• Exfiltrate information accessible to the administrator.

The vulnerability primarily impacts confidentiality and integrity.

Severity

NVD has not yet published its own CVSS assessment; the current score is provided by the Mautic CNA.

Conceptual Vulnerable Code

Note: The vendor has not published the exact vulnerable source code. The following illustrates the vulnerability pattern.

// Project name retrieved from the server
const projectName = response.project.name;

// Unsafe: inserts user-controlled HTML
popover.innerHTML = `
    <span class="project-tag">
        ${projectName}
    </span>
`;

Why It Is Vulnerable

innerHTML causes the browser to parse the stored project name as HTML. If the project name contains HTML elements with JavaScript event handlers, the browser executes them when rendering the popover.

Corrected Code (Conceptual)

const tag = document.createElement("span");
tag.className = "project-tag";

// Safe: treat input as plain text
tag.textContent = response.project.name;

popover.replaceChildren(tag);

Why This Fix Works

Using textContent ensures that the project name is treated as literal text instead of HTML. Any HTML special characters are displayed rather than interpreted by the browser, preventing execution of embedded scripts. Where HTML rendering is required, developers should sanitize untrusted content using a well-maintained HTML sanitizer before insertion.