Mautic Core: Unrestricted file upload in campaign import leading to code execution
Summary
An authenticated user with permission to create campaign imports can upload arbitrary files, including server-side scripts, into a publicly accessible media directory of Mautic 7. On web servers that execute scripts in per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this can lead to remote code execution with the privileges of the web server user. An attacker could then read the Mautic configuration, application secrets and contact data. Administrator rights are not required.
Affected
- mautic/core 7.0.0 to before 7.2.2
- Mautic 6.x, 5.x and 4.x are not affected according to the vendor
Fixed in
- Upgrade to mautic/core 7.2.2
Workaround
- No official workaround exists according to the vendor.
- Remove the campaign import create permission from users who do not strictly need it and limit it to trusted administrators.
- Configure the web server at server or virtual-host level to deny script execution in the media/ directory.
Exploitation
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No evidence of active exploitation or public proof of concept found in the research.
Our recommendation
- Upgrade Mautic 7.x instances to 7.2.2 as a priority.
- Until the upgrade, restrict campaign import permissions to trusted administrators.
- Block script execution in the media directory on the web server.
- Check the media directory for unexpected files and review user permissions and access logs.
- Consider the related path traversal CVE-2026-9559 in the same feature when deciding how far to limit access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mxjf-pghx-h299 github.com
- CVE record summary (OpenCVE) app.opencve.io
- Mautic 7.2.2 release listing github.com
- OffSeq threat radar radar.offseq.com
- CVE-2026-9559 (related advisory, GitLab) advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:53.
Original description (NVD)
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.