Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-115188: Mautic 7 campaign import lets attackers run code
CVE-2026-115188 · published 9 days ago
Summary
Mautic version 7 lets users who can create a campaign upload files without checking their names or types. A malicious user can place a script in a public folder and cause the server to execute it, exposing configuration, secrets, and contact data. Apply the vendor's patch or restrict the upload feature and file types immediately.
Original advisory text
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publ...
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.
References
- https://github.com/mautic/mautic/security/advisories/GHSA-mxjf-pghx-h299 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-1151... Vendor Advisory
- https://github.com/mautic/mautic Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-115188 Vendor Advisory
- https://packagist.org URL
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-94Code Injection
CWE-434Unrestricted File Upload
Timeline
Published26 Oct 2026
Updated31 Oct 2026
First seen26 Oct 2026
Track software like this
Free during beta