Log in Start free

Vulnerability · Published Jul 9, 2025 · Assigned by Mautic

CVE-2025-7381Exposure of sensitive PHP information to an unauthorized control sphere in mautic/mautic images

Medium 5.3

In plain English

A medium-severity security flaw in Docker Mautic from mautic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 79.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses. WorkaroundsThe mitigation requires changing the expose_php variable from "On" to "Off" in the file located at /usr/local/etc/php/php.ini.

Affected products (as reported)

VendorProductVersions
mautic Docker Mautic <= 6.0.3-20250707-apache<= 6.0.3-20250707-fpm<= 5.2.7-20250707-apache<= 5.2.7-20250707-fpm

Weakness: CWE-497 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References