CVE-2026-9559

Vulnerability

A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, the validation logic fails to properly sanitize file paths, allowing them to escape intended temporary directories. Affected versions include Mautic 7.x prior to 7.1.2. Versions 6.x, 5.x, and 4.x are not affected [1].

Exploitation

An attacker must be authenticated and hold the campaign:imports:create privilege. The attacker crafts a ZIP archive containing files with path traversal sequences (e.g., ../). Upon uploading and extraction during a campaign import, the flawed validation permits the file paths to write outside the intended temporary directory, allowing placement of files into sensitive system directories [1].

Impact

Successful exploitation allows the attacker to write arbitrary PHP files to sensitive directories, such as those containing internal configuration or cache components. This can lead to remote code execution (RCE) under the context of the web server user, resulting in full compromise of the application and potentially the underlying server [1].

Mitigation

The vulnerability is fixed in Mautic version 7.1.2, released on an unspecified date [1]. No official workarounds are available; however, administrators can mitigate risk by revoking the campaign:imports:create permission from non-administrative users until upgrading is possible [1].