CPE
Mautic 7 allows authenticated users with campaign import permissions to achieve remote code execution by uploading arbitrary malicious files to a publicly accessible directory.