Mautic: Unrestricted file upload remote code execution (CVE-2026-115188)

Mautic 7 contains an unrestricted file upload vulnerability (CVE-2026-115188) in the campaign import feature. An authenticated user with sufficient permissions can upload arbitrary files through the UI or the /api/campaigns/import endpoint. These files are moved to a publicly accessible media directory without validation of filename or extension. On web server configurations (e.g., Apache) that permit script execution in media directories, this enables remote code execution with the privileges of the web server user.

Impact

Successful exploitation allows remote code execution on the underlying web server. This results in potential unauthorized access to the Mautic application configuration, environment secrets, and sensitive contact data stored within the database or filesystem.

Recommendation

1. Identify all Mautic 7 instances within the environment.
2. Restrict campaign import permissions to only trusted, highly vetted service accounts until a vendor patch is applied.
3. Update or apply security hardening to web server configurations to disable script execution (e.g., PHP, Perl) in the Mautic media/upload directories.
4. Review access logs for non-standard file extensions or suspicious filenames being uploaded via the /api/campaigns/import endpoint.