CVE-2026-9559: Mautic Core Path Traversal Vulnerability in Campaign Import
Summary
CVE-2026-9559: Mautic vulnerable to Path Traversal via Campaign Import. Affects mautic/core versions >= 7.0.0, < 7.1.2. Fixed in 7.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation platform that enables businesses to manage and automate their marketing campaigns effectively. It provides features such as email marketing, landing pages, and campaign management. However, Mautic 7 has a critical vulnerability in its campaign import feature that allows unauthorized file access, posing significant security risks.
Vulnerability Detail
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. This vulnerability can be exploited by an authenticated user with campaign import privileges to write arbitrary PHP files to sensitive system directories. An attacker can leverage this to overwrite critical internal configuration or cache components, resulting in Remote Code Execution (RCE) under the context of the web server user.
How To Fix
Minimum fixed version
7.1.2
This is the first release that contains the fix.
composer require mautic/core:7.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As there are no official workarounds, it is recommended to revoke campaign import permissions (campaign:imports:create) from non-administrative users to mitigate the risk until the package is updated.
Conclusion
The path traversal vulnerability in Mautic's campaign import feature poses a significant risk to users, allowing potential remote code execution. It is crucial to update to the patched version 7.1.2 or later to mitigate this risk. Additionally, revoking import permissions for non-administrative users can help reduce exposure until the update is applied.
See every vulnerability recorded for mautic/core →
FAQ
The CVSS score of this vulnerability is 9.9, indicating a critical level of severity.
The vulnerability affects Mautic version 7.0.0 up to 7.1.1. Versions 7.1.2 and later are patched.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to Remote Code Execution (RCE), allowing attackers to execute arbitrary code on the server.
Mautic 6.x, 5.x, and 4.x branches are not affected by this vulnerability. For legacy support, refer to the Extended Long-Term Support (ELTS) page.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
