An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7.
Impact
Mautic 7.0.0 is affected by an unrestricted file upload vulnerability in the campaign import feature, allowing authenticated users to upload arbitrary files. Administrator privileges are not required. This may lead to remote code execution on certain web servers.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
There are no official workarounds. To mitigate this vulnerability without upgrading, remove the campaign import create permission from all users who do not strictly need it and restrict it to trusted administrators, and configure the web server at server or virtual-host level, so that it cannot be overridden by files in the application directory, to deny script execution in the media/ directory.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Vendor not supplied · Mautic
mautic/core
1 range
Vendor not supplied · Mautic
mautic/core
Compare with this publisher’s ranges. This does not inspect your installation.
affected
7.0.0 → before 7.2.2
semver versions
Other versions: unaffected
Original source description
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-115188View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.