CVE-2026-115188
Deferred Deferred - Pending Action

Unrestricted File Upload in Mautic 7 Leads to RCE

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Mautic

Description
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115188
EUVD
EUVD-2026-109791

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mautic mautic From 7.0.0 (inc) to 7.2.1 (inc)
mautic mautic 7.2.2
mautic mautic 7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-115188 is a critical remote code execution vulnerability in Mautic versions 7.0.0 to 7.2.1. It stems from an unrestricted file upload flaw in the campaign import feature. When a user uploads a campaign archive, the application copies bundled asset files into a publicly accessible media directory without validating file names or types. This allows authenticated users with import permissions to upload arbitrary files, including server-side scripts, via the UI or API endpoint /api/campaigns/import.

On default Apache setups, such as the official Mautic Docker image, this leads to remote code execution with the web server's privileges. The vulnerability has been patched in version 7.2.2, while older branches (6.x, 5.x, 4.x) are unaffected.

Detection Guidance

Check for unauthorized files in the Mautic media directory, particularly files with executable extensions like .php, .jsp, or .asp. Review web server access logs for suspicious uploads to /api/campaigns/import. Inspect Mautic user permissions for campaign import access.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on the server with the web server's privileges. They can access sensitive configuration data like database credentials, modify application data, and store persistent files in public directories. If the web server blocks script execution in the media directory, the impact is limited to arbitrary file writes.

Compliance Impact

This vulnerability could lead to severe compliance violations under GDPR and HIPAA due to unauthorized access to sensitive data. Attackers gaining code execution may exfiltrate personal data, violating GDPR's data protection principles. For HIPAA, unauthorized access to protected health information could result in breaches. Both regulations mandate strict controls to prevent such exposures.

Mitigation Strategies

Upgrade Mautic to version 7.2.2 or later. Restrict campaign import permissions to trusted administrators only. Configure the web server to block script execution in the media directory. Monitor for unauthorized file uploads in the media directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115188. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart