CVE-2022-25769

Improper regex in htaccess file

7.2 HighFix available

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: High

Exploit likelihood

0.51%Up 0.5 points since Sep 19, 2024

What each source reports

CVE List Score used 7.2

Improper regex in htaccess file

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

Record: CVE-2022-25769
CVSS 3.1: 7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
Weakness: CWE-1284
Updated: 2026-11-02

EUVDEUVD-2022-1482 7.2

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

Record: EUVD-2022-1482
CVSS 3.1: 7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-mj6m-246h-9w56 No score

Improper regex in htaccess file

Impact

the default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

Patches

Please upgrade to 3.3.5 or 4.2.0

Workarounds

References

Release post: https://www.mautic.org/blog/community/mautic-4-2-one-small-step-mautic
Internally tracked under MST-32

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

Record: GHSA-mj6m-246h-9w56
Updated: 2026-11-02

NVD 7.2

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

Record: CVE-2022-25769
CVSS 3.1: 7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-1284
Updated: 2026-11-02

OSV 7.2

Improper regex in htaccess file

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

Record: CVE-2022-25769
CVSS 3.1: 7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
Weakness: CWE-1284
Updated: 2026-11-02

OSVGHSA-mj6m-246h-9w56 No score

Improper regex in htaccess file

Impact

the default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

Patches

Please upgrade to 3.3.5 or 4.2.0

Workarounds

References

Release post: https://www.mautic.org/blog/community/mautic-4-2-one-small-step-mautic
Internally tracked under MST-32

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

Record: GHSA-mj6m-246h-9w56
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`mautic/core` Packagist	before 3.3.5	3.3.5
`mautic/core` Packagist	4.0.0 up to 4.2.0	4.2.0
`mautic/core` Packagist	before 3.3.5, plus listed versions 1.0.01.0.0-beta1.0.0-beta21.0.0-beta31.0.0-beta4 Show 45 moreShow less 1.0.0-rc11.0.0-rc21.0.0-rc31.0.0-rc41.0.11.0.21.0.31.0.41.0.51.1.01.1.11.1.21.1.31.2.01.2.0-beta11.2.11.2.21.2.31.2.41.3.01.3.11.4.01.4.12.0.02.0.12.1.02.1.12.10.02.10.0-beta2.10.12.11.02.11.0-beta2.12.02.12.0-beta2.12.12.12.1-beta2.12.22.12.2-beta2.13.02.13.0-beta2.13.12.14.02.14.0-beta2.14.12.14.1-beta	3.3.5
`mautic/core` Packagist	4.0.0 up to 4.2.0, plus listed versions 4.0.14.0.24.1.04.1.14.1.24.2.0-rc4.2.0-rc1	4.2.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-25769 is a high vulnerability (CVSS 7.2) in Acquia Mautic, published March 1, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in mautic/core 3.3.5.

References

This page doesn't list everything

Left out here: 67 versions. The JSON record has them.