An insecure deserialization flaw in Mautic allows an attacker who can store a crafted serialized value in segment filters or custom field properties to trigger the instantiation of arbitrary PHP objects. Because the deserialization does not restrict allowed classes, an attacker can chain gadget objects present in Mautic dependencies to execute arbitrary code on the server, potentially reading, modifying, or deleting data such as contact information and disrupting service availability. This flaw exposes the full range of confidentiality, integrity and availability risks inherent to code execution on the web application.

Mautic is affected; all installations that use the segment filter or custom field mechanisms are vulnerable. The specific version range is not documented in the advisory, so all currently installed Mautic instances should be considered at risk.

The CVSS score of 8 indicates a high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to have high‑privilege or write access to the affected database fields, so the attack vector is likely internal or through an authenticated compromised account. If these conditions are met, the attacker can achieve remote code execution and full data compromise.