CVE-2026-9559: A path traversal vulnerability exists in the campaign import feature of Mautic 7

Synopsis

A path traversal flaw in Mautic 7's campaign import feature lets an authenticated user with campaign:imports:create privileges write arbitrary PHP files outside the intended temporary directories when a ZIP archive is extracted. The bug is reachable over the network and requires only a low-privilege account, and successful exploitation overwrites configuration or cache files to gain remote code execution as the web server user. A patched-image rebuild at Mautic 7.1.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Mautic web interface must be reachable over the network for the attacker to submit the malicious campaign import.

• AuthenticationRequired

  The attacker needs a valid Mautic account that holds the campaign:imports:create privilege; any low-privilege user with that role is sufficient.

• Victim interactionNot required

  No victim action is needed; the attacker drives the import flow directly.

• Attack complexityDetail

  Attack complexity is low: the ZIP extraction path-validation flaw is reliably triggered without race conditions or environmental tuning.

Blast Radius

• Writes attacker-controlled PHP files into sensitive directories outside the temporary upload location.
• Overwrites configuration or cache components to achieve remote code execution as the web server user.
• Reads and exfiltrates application secrets, database credentials, and stored customer marketing data.
• Modifies or destroys Mautic data and can pivot to other services reachable from the web server.