CVE-2026-115188 in Mautic
Summary
by MITRE • 10/26/2026
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in Mautic 7 represents a critical security flaw within its campaign import functionality, specifically classified under CWE-434 as an Unrestricted Upload of File with Dangerous Type. This issue arises from the application's failure to validate or sanitize file names and types when processing uploaded campaign archives. When a user initiates a campaign import by uploading an archive containing asset files, the backend logic copies these bundled assets directly into a publicly accessible media directory without implementing necessary restrictions on the destination filenames or their extensions. This lack of input validation allows attackers to bypass standard security controls that typically prevent the execution of malicious code within web-accessible directories.
The operational impact of this vulnerability is severe, as it enables remote code execution with the privileges of the web server process. An authenticated user who possesses permission to create campaign imports can exploit this flaw through either the graphical user interface or the REST API endpoint located at /api/campaigns/import. By crafting a malicious archive that includes server-side scripts such as PHP files disguised within the asset bundle, an attacker can successfully place these executable files into the web root. This capability does not require administrator privileges, significantly lowering the barrier to entry for exploitation and allowing any authenticated user with basic import permissions to compromise the entire system.
The consequences of this remote code execution extend beyond simple script execution. On web server configurations that honor per-directory settings, such as the default Apache setup found in the official Mautic Docker image, the executed scripts run under the context of the web server user. This grants the attacker full access to sensitive application data stored on the filesystem, including configuration files containing database credentials and application secrets. Furthermore, it provides unrestricted read and write access to contact data and other personally identifiable information managed by the marketing automation platform, leading to potential data breaches and compliance violations under regulations such as GDPR or CCPA.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Initial Access via Valid Accounts and Execution via Command and Script Interpreter. The attack vector leverages legitimate application features for malicious purposes, making detection through standard intrusion prevention systems more challenging without specific behavioral monitoring of file system changes in web directories. To mitigate this risk, immediate remediation should involve applying the latest security patches provided by Mautic that enforce strict validation on uploaded filenames and restrict allowed extensions to non-executable types such as images or documents only. Additionally, administrators should ensure that their web server configurations prevent script execution within upload directories using directives like Options -ExecCGI in Apache or equivalent settings in Nginx, thereby adding a critical layer of defense-in-depth even if application-level validation is bypassed.