{
 "slug": "mautic",
 "name": "Mautic",
 "tagline": "Marketing automation platform for campaigns, lead scoring and email",
 "category": "business-apps",
 "use_cases": [
  "marketing-automation",
  "lead-nurturing",
  "email-campaigns"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Mautic Community (Open Source Collective)",
  "url": "https://mautic.org",
  "license": "GPL-3.0",
  "license_url": "https://github.com/mautic/mautic/blob/7.x/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "7.2.1",
   "last_build": "2026-10-23",
   "entity_id": "prod-4kpgzxudpcqzq",
   "ami_alias": "/aws/service/marketplace/prod-4kpgzxudpcqzq/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-ktthq5xcevhvy",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "7.2.1",
   "last_build": "2026-10-26",
   "offer_id": "mautic",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:mautic:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.mautic?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/mautic/",
  "json": "https://lynxroute.com/products/mautic/product.json"
 },
 "release_notes": [
  {
   "version": "7.2.1",
   "title": "Mautic 7.2.1 r2",
   "notes": "* Security: fixes PHP2Shell (CVE-2026-109618, CVE-2026-109619), an unauthenticated remote code execution flaw in PHP, by shipping Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Every earlier image of this product carries the vulnerable PHP; replace running instances or run: sudo apt-get update && sudo apt-get install --only-upgrade \"php8.3*\"\n* The application version is unchanged (Mautic 7.2.1); this is a security rebuild\n* HTTPS on by default: self-signed TLS on port 443; Certbot pre-installed - sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23",
    "azure": "2026-10-26"
   }
  },
  {
   "version": "7.2.1",
   "title": "Mautic 7.2.1",
   "notes": "* Mautic updated 7.2.0 -> 7.2.1, a bugfix release. GPL-3.0 unchanged\n* Campaign emails now arrive at the intended local time for contacts ahead of UTC, and scheduled campaign events no longer repeat endlessly\n* Dynamic web content tokens now work inside links and buttons, and email link validation works again on production installs\n* Reports filtered by tag return the right results, and two Mautic forms from different instances can share one web page\n* HTTPS on by default: self-signed TLS on port 443 (HTTP redirects to HTTPS)\n* Certbot pre-installed - swap in a trusted cert: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23",
    "azure": "2026-10-26"
   }
  },
  {
   "version": "7.2.0",
   "title": "Mautic v7.2.0",
   "notes": "* Mautic updated to 7.2.0 \"Lynx Edition\" - a feature release spanning campaigns, contacts, email and reporting\n* Campaign builder gains an infinite canvas with space-bar panning and inline event IDs, a command that recovers stuck campaign events, and the option to stop a campaign sending past a chosen date and time\n* Contacts gain tag and stage merging, bulk find-and-replace across contact and company field values, a date-grouped timeline, and upcoming events on the timeline\n* Email gains truly transactional sends, tokens in the From address and name, and global defaults for the preference centre and UTM tracking parameters\n* Contact notes now carry dedicated permissions, applied to existing roles automatically\n* HTTPS on by default: self-signed TLS on port 443 (HTTP redirects to HTTPS)\n* Certbot pre-installed - swap in a trusted cert: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-09-07"
   }
  },
  {
   "version": "7.1.3",
   "title": "Mautic v7.1.3",
   "notes": "* Updated Mautic to 7.1.3\n* HTTPS on by default: self-signed TLS on port 443 (HTTP redirects to HTTPS)\n* Certbot pre-installed - swap in a trusted cert: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-10",
    "azure": "2026-07-13"
   }
  },
  {
   "version": "7.1.2",
   "title": "Mautic 7.1.2 - June 2026",
   "notes": "Security release: fixes for SQL injection, SSRF, server-side template injection, path traversal, API authorization bypass, and stored XSS; vulnerable dependency updates.\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-01",
    "azure": "2026-06-22"
   }
  },
  {
   "version": "7.1.1",
   "title": "Mautic 7.1.1 - Initial release (May 2026)",
   "notes": "* Mautic 7.1.1 Community Edition on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* MariaDB 10.11 with per-instance password rotated at first launch\n* PHP 8.3-FPM with workers and OPcache auto-tuned from instance RAM\n* MariaDB bound to 127.0.0.1 only - no exposed database port\n* Customer-driven admin via the upstream Mautic installer wizard - no admin account baked into the AMI\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-05-19"
   }
  }
 ],
 "release_history": [
  {
   "version": "7.2.1",
   "aws": "2026-10-23",
   "azure": "2026-10-26"
  },
  {
   "version": "7.2.0",
   "aws": "2026-09-04",
   "azure": "2026-09-07"
  },
  {
   "version": "7.1.3",
   "aws": "2026-07-10",
   "azure": "2026-07-13"
  },
  {
   "version": "7.1.2",
   "aws": "2026-07-01",
   "azure": "2026-06-22"
  },
  {
   "version": "7.1.1",
   "aws": "2026-05-19"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-4kpgzxudpcqzq/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer mautic --plan payg-gen2\naz vm create -g my-rg -n mautic --size Standard_D2s_v3 \\\n  --image lynxroute:mautic:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Mautic is the leading open-source marketing automation platform - a Symfony 7 PHP 8 web application served by Nginx with PHP-FPM and MariaDB. The bundled feature set covers email campaigns and broadcasts, drip workflows and trigger-based automation, lead segmentation and scoring, landing pages and signup forms, multi-channel campaigns (email, SMS, social), A/B testing, contact lifecycle reporting, REST API, and a web hook engine. Connects to any standard SMTP relay (Amazon SES, SendGrid, Mailgun, Postmark, Postfix) for outbound delivery. Persists contacts, segments, campaigns, templates, and tracking data in MariaDB. A drop-in self-hosted alternative to HubSpot, Mailchimp, ActiveCampaign, and Marketo for B2B teams, agencies, and GDPR-sensitive organisations who keep their contact database inside their own AWS account. GPL-3.0 license, governed by the Mautic community under the Open Source Collective - no per-contact fees, no vendor lock-in.",
  "image_adds": "Security hardening:\n* Per-instance MariaDB password generated and rotated at first launch (never the same on two deployments)\n* Customer-driven admin via the upstream Mautic installer wizard - no admin account baked into the image\n* MariaDB bound to 127.0.0.1 only - no exposed database port\n* PHP-FPM auto-tuned at first launch (workers and OPcache sized from instance RAM)\n* UFW firewall pre-configured - ports 22, 80, and 443 only\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}