mahocommerce/maho

Packagist1 known CVE affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting mahocommerce/mahopage 1 of 1

CVE-2025-58449HIGHCVSS 8.7EG 0.0✓ Fixed in 25.9.0
2025-09-08
vulnerable: 24.11.0 ... 25.7.0 (6 versions)
Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to the `Dashboard` and `Catalog\Manage Products` permissions can create a custom option on a listing with a file input fiel…

Check whether mahocommerce/maho is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for mahocommerce/maho CVEs against the assets you own.

Start Free Scan →