External risk intelligence

Mautic Campaign Import Path Traversal Leads to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-9559

The vulnerability exists in the campaign import feature of a marketing automation platform. While the application is often web-facing, this specific functionality requires authenticated user access with specific administrative privileges, making direct, unauthenticated public internet exploitation less common.

Path Traversal

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a marketing automation platform that allows an authenticated user to execute arbitrary code on the server. This occurs through a path traversal flaw during the campaign import process, enabling an attacker to overwrite critical system files.

Allows code execution via file import.
Critical system overwrite risk.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to import campaigns can upload a specially crafted ZIP file that exploits a path traversal flaw. This allows files to be written outside of their intended location, potentially overwriting system files and leading to code execution.

Requires authenticated user with import privileges.
Uploading a crafted ZIP file.
Leads to arbitrary file write and RCE.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated user with specific privileges to write arbitrary PHP files to sensitive system directories within Mautic. This occurs when the campaign import feature processes uploaded ZIP files, and a flaw in the validation logic permits file paths to escape their intended temporary locations. When supported by the advisory, this could lead to the overwriting of critical internal configuration or cache components, potentially resulting in Remote Code Execution (RCE) under the context of the web server user.

System configuration files.
Arbitrary PHP file write to web server directories.
Remote code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

Infrastructure and application teams are likely responsible for addressing this vulnerability in Mautic. The first practical step is to identify all instances of Mautic, determine their exposure and business criticality, and locate the accountable owner for each. Remediation planning should then proceed based on the assessed risk.

Application owners should prioritize investigation.
Verify Mautic instances and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Mautic?

Mautic is an open-source marketing automation platform used by organizations to manage email campaigns, track lead behavior, and automate digital customer journeys. It serves as a central hub for marketing operations, handling user data and complex workflow processes that require persistent access to server-side resources to execute scheduled tasks and manage application assets.

What does path traversal mean for CVE-2026-9559?

This vulnerability, classified as CWE-22, means the software fails to properly sanitize file paths within uploaded ZIP files. In this specific case, it allows an attacker to 'escape' the intended temporary directory during a campaign import. Because the application processes these paths incorrectly, it can be forced to write files into sensitive system locations, potentially replacing legitimate configuration files with malicious PHP code that the server then executes.

How is this campaign import flaw triggered?

The vulnerability is triggered only when an authenticated user with 'campaign:imports:create' privileges uploads a specially crafted ZIP file through the campaign import feature. If a user lacks these specific administrative permissions, or if the system is not actively processing a malicious import package, this path traversal flaw cannot be weaponized. Simply accessing the Mautic dashboard or using other, unrelated features does not trigger the execution of this vulnerability.

Is my Mautic instance at risk according to Halo Surface Signal?

Halo Surface Signal notes that while Mautic is often accessible over the internet, this specific risk is not unauthenticated. Because the attack requires active user privileges to trigger, it is less likely to be exploited directly by random public traffic. Your level of risk depends primarily on how strictly you control which accounts possess campaign import privileges and whether those accounts have been compromised.

What should I do if I run Mautic?

Begin by auditing your Mautic instances to identify where they are deployed and confirming which users are assigned the 'campaign:imports:create' privilege. Restrict this capability to the minimum number of trusted individuals until an update is applied. Ensure your security and infrastructure teams are aware of the potential for unauthorized file overwrites, and monitor for any unusual activity involving administrative imports while planning for official software patches.

References

github.com/mautic/mautic/security/advisories/GHSA-6r9h-4h75-7q4x

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.