Executive Summary

A critical vulnerability (CVE-2026-115188) with a CVSS score of 9.9 exists in Mautic 7, an open-source marketing automation platform. This unrestricted file upload vulnerability allows an authenticated user with permission to create campaign imports to upload arbitrary files, including server-side scripts, into the web root, leading to remote code execution with the privileges of the web server user.

Technical Analysis

The vulnerability class is an unrestricted file upload vulnerability, specifically a CWE-94 (Code Injection) and CWE-434 (Unrestricted Upload of File with Dangerous Type). The attack vector involves an authenticated user with permission to create campaign imports exploiting this vulnerability through the user interface or the API (/api/campaigns/import). The root cause is the application's failure to restrict file names or types when processing uploaded campaign archives.

How It Gets Exploited

An attacker with authenticated access and permission to create campaign imports can exploit this vulnerability. The attacker would upload a campaign archive containing a malicious server-side script. When the application processes this archive, it copies the bundled asset files into a publicly accessible media directory without validation. This allows the attacker to place arbitrary files, including server-side scripts, in the web root. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user. The attacker can then access the Mautic configuration, application secrets, and contact data.

Impact Assessment

Mautic versions 7.0.0 to 7.2.2 are affected by this vulnerability. An attacker can achieve remote code execution, potentially leading to confidentiality, integrity, and availability impacts. The CVSS score of 9.9 indicates a critical severity level.

Recommended Actions

To mitigate this vulnerability, it is recommended to update Mautic to version 7.2.2 or later. Additionally, administrators should:
  • Verify that no suspicious files have been uploaded to the media directory.
  • Monitor for unusual activity, such as unexpected API calls or changes in the web root.
  • Implement additional security measures, such as restricting access to the campaign import feature and validating file uploads.

Sources