Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2025-7381

Exposure of sensitive PHP information to an unauthorized control sphere in mautic/mautic images

Medium5.3EPSS 0.28%
Published
Updated
Reserved
Assigned by
Mautic

Description

ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses. WorkaroundsThe mitigation requires changing the expose_php variable from "On" to "Off" in the file located at /usr/local/etc/php/php.ini.

Scores

CVSS scores of CVE-2025-7381, by who scored it
Scored byCVSSScoreVector
MauticCNA (assigner)3.1Medium5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVDNVD · Deferred3.1Medium5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS (exploitation in 30 days)
0.28% · top 80% of all CVEs (5 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

Affected products

  • mautic · Docker Mautic

    • affected <= 6.0.3-20250707-apache
    • affected <= 6.0.3-20250707-fpm
    • affected <= 5.2.7-20250707-apache
    • affected <= 5.2.7-20250707-fpm

What to do

Workaround: The mitigation requires changing the expose_php variable from "On" to "Off" in the file located at /usr/local/etc/php/php.ini.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-7381 badge
[![CVE-2025-7381](https://trackcve.app/badge/CVE-2025-7381.svg)](https://trackcve.app/cve/CVE-2025-7381)

Record last updated .