# Security concerns

**URL:** <https://forum.mautic.org/t/security-concerns/38040>\
**Category:** Mautic 6 Install/Upgrade Support\
**Tags:** security\
**Created:** [April 4, 2026, 7:16pm UTC](https://forum.mautic.org/t/security-concerns/38040 "2026-04-04T19:16:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![crozilla](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/crozilla/32/2054_2.png) [@crozilla](https://forum.mautic.org/u/crozilla)\
**Post date:** [April 4, 2026, 7:16pm UTC](https://forum.mautic.org/t/security-concerns/38040/1 "2026-04-04T19:16:44Z")

</div>

**Your software**  
My Mautic version is: 6.0.7  
My PHP version is: 8.1.33  
My Database type and version is: MySQL 8.0.41-0ubuntu0.24.04.1

**Your problem**  
My problem is: Cannot upgrade MySQL to 8.4, is my instance at serious risk from hackers? Am I okay to just stay on 6.0.7? Or are there serious security issues?

These errors are showing in the log: None. Mautic is working fine.

Steps I have tried to fix the problem: Tried to get my webhost to upgrade me but they won’t for awhile.

---

<div class="post-metadata">

**Author:** ![bastianhammer](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/bastianhammer/32/14826_2.png) [@bastianhammer](https://forum.mautic.org/u/bastianhammer)\
**Post date:** [April 8, 2026, 4:29pm UTC](https://forum.mautic.org/t/security-concerns/38040/2 "2026-04-08T16:29:37Z")

</div>

Hello,

you’re talking about the 6.0.8 security release which addresses this here:

> **[SQL Injection in Contact Activity API Sorting](https://github.com/mautic/mautic/security/advisories/GHSA-r5j5-q42h-fc93)**
>
> \### Summary
> This advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activ...

The DB version is usually not that critical, however PHP requirements will change over time:

> **[Mautic Requirements - Mautic](https://mautic.org/mautic-requirements/)**
>
> Mautic requires a robust hosting environment and should not be installed on shared hosting platforms.

Often, security issues are mitigated by some circumstances / setup etc.  
For specifics you’d need to check the code itself. But overall, now that everybody can compare the code changes 6.0.7 to 6.0.8 it’s fairly simple to put these changes into any AI and ask it how to exploit / test this.

Do you have your API enabled?

In general, Mautic isn’t like WordPress. It’s suggested to run Mautic on a VPS where you’ve got control over the system: [https://mautic.org/mautic-requirements/](https://mautic.org/mautic-requirements/)  
If this security issue won’t affect your specific instance and setup, maybe the next one will.  
Not being able to upgrade is a bad situation and you should find a way out. Maybe not right now, but better sooner than later.