External risk intelligence

Mautic Unrestricted File Upload Leads to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-115188

The vulnerability exists in a marketing automation platform's campaign import feature, accessible via the application's user interface and API. Mautic is commonly deployed as a web-facing application to manage marketing campaigns. Because it provides API endpoints and web-based management interfaces that are frequently exposed to the internet to support remote campaign operations, the surface is likely to be reachable.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Mautic, a marketing automation platform, by allowing authenticated users to upload arbitrary files, including malicious scripts, into a web-accessible directory. If exploited, this could enable an attacker to execute code on the server, potentially compromising sensitive company data and application secrets. The main concern is confirming relevance and exposure within our environment.

Malicious file uploads can lead to server code execution.
It impacts marketing platforms used for customer outreach.
Confirm if Mautic is used and if this feature is active.

Attack Path

How an attacker could exploit the issue

An attacker with existing access to Mautic can upload malicious files through the campaign import feature. This feature copies uploaded files to a public area without checking their type or name, allowing an attacker to place executable scripts on the server. When the server processes these files, it can lead to the execution of arbitrary code.

Attacker needs campaign import permission.
Upload arbitrary files via UI or API.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user could upload arbitrary files, including server-side scripts, into a publicly accessible directory through the campaign import feature. This could lead to remote code execution, potentially exposing sensitive information such as Mautic configuration, application secrets, and contact data, depending on the web server's configuration.

Arbitrary files, including scripts.
Uploads via UI or API.
Remote code execution possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Mautic deployments and requires immediate attention from teams managing the application and its underlying infrastructure. The first step is to identify all instances of Mautic, confirm their internet-facing status and business criticality, and then assign ownership for remediation planning.

Application and Infrastructure Owners
Verify Mautic instance exposure and criticality.
Plan and coordinate remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Mautic 7 and how is it used?

Mautic is an open-source marketing automation platform. Organizations use it to manage customer outreach, automate email campaigns, and track lead behavior. It typically runs as a web-based application, often deployed via Docker, to handle significant volumes of contact data and marketing assets.

What does CWE-434 mean for CVE-2026-115188?

This vulnerability is an unrestricted file upload flaw. The application fails to validate the type or name of files uploaded through its campaign import tool. This allows a user to move files—including malicious server-side scripts—directly into a public directory where the web server might attempt to run them.

How is this file upload bug triggered?

An attacker with existing, non-administrator permissions to import campaigns can trigger this by uploading a specially crafted archive. The bug does not require high-level privileges; however, it specifically relies on the application's failure to sanitize the file paths and types during the import process via the UI or API.

Do I need to worry if my instance is internal?

Halo Surface Signal notes that Mautic is often internet-facing to support remote marketing operations, increasing the likelihood of exposure. While internet-facing instances are at higher risk, any deployment where the web server environment allows script execution in the media directory remains vulnerable to unauthorized access.

How should I respond to this threat?

Begin by identifying all Mautic instances in your environment and confirming who owns them. Assess whether these instances are exposed to the internet. Once located, coordinate with your infrastructure teams to restrict access to the campaign import feature and monitor for official software updates that address the file validation logic.

References

github.com/mautic/mautic/security/advisories/GHSA-mxjf-pghx-h299

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.