CVE-2026-115188 Details

A vulnerability allowing unrestricted file uploads has been identified in the campaign import feature of Mautic version 7. This issue arises because the application processes uploaded campaign archives by copying the included asset files into a publicly accessible media directory, without restricting file names or types. An authenticated user with permission to create campaign imports can exploit this vulnerability through the user interface or the API endpoint '/api/campaigns/import'. This allows the user to upload arbitrary files, including server-side scripts, to the web root. The vulnerability does not require administrator privileges. On web servers that honor per-directory configurations, such as the default Apache setup in the official Mautic Docker image, this exploitation can lead to remote code execution with the privileges of the web server user. Consequently, the attacker could access the Mautic configuration, application secrets, and contact data.

Users can upgrade to Mautic version 7.2.2 to address this vulnerability. For those using earlier versions of Mautic 7, it is recommended to remove the campaign import permission from users who do not need it and to configure the web server to deny script execution in the media directory.