{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-115188",
        "assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
        "state": "PUBLISHED",
        "assignerShortName": "Mautic",
        "dateReserved": "2026-10-22T06:39:08.913Z",
        "datePublished": "2026-10-26T12:33:54.469Z",
        "dateUpdated": "2026-10-26T12:36:35.943Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
                "shortName": "Mautic",
                "dateUpdated": "2026-10-26T12:36:35.943Z"
            },
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-434",
                            "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                            "type": "CWE"
                        },
                        {
                            "lang": "en",
                            "cweId": "CWE-94",
                            "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-650",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-650 Upload a Web Shell to a Web Server"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "collectionURL": "https://packagist.org",
                    "packageName": "mautic/core",
                    "repo": "https://github.com/mautic/mautic",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "7.0.0",
                            "lessThan": "7.2.2",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data."
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://github.com/mautic/mautic/security/advisories/GHSA-mxjf-pghx-h299"
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV3_1": {
                        "version": "3.1",
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "privilegesRequired": "LOW",
                        "userInteraction": "NONE",
                        "scope": "CHANGED",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "HIGH",
                        "availabilityImpact": "HIGH",
                        "baseSeverity": "CRITICAL",
                        "baseScore": 9.9,
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
                    }
                }
            ],
            "workarounds": [
                {
                    "lang": "en",
                    "value": "There are no official workarounds. To mitigate this vulnerability without upgrading, remove the campaign import create permission from all users who do not strictly need it and restrict it to trusted administrators, and configure the web server at server or virtual-host level, so that it cannot be overridden by files in the application directory, to deny script execution in the media/ directory.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "There are no official workarounds. To mitigate this vulnerability without upgrading, remove the campaign import create permission from all users who do not strictly need it and restrict it to trusted administrators, and configure the web server at server or virtual-host level, so that it cannot be overridden by files in the application directory, to deny script execution in the media/ directory."
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Moath Aloufi (@m0xath)",
                    "type": "finder"
                },
                {
                    "lang": "en",
                    "value": "@iys8",
                    "type": "finder"
                },
                {
                    "lang": "en",
                    "value": "David Carliez (@DavidCarliez)",
                    "type": "finder"
                },
                {
                    "lang": "en",
                    "value": "@Forrof",
                    "type": "finder"
                },
                {
                    "lang": "en",
                    "value": "@sdrk3nD",
                    "type": "finder"
                },
                {
                    "lang": "en",
                    "value": "@Hama1cco",
                    "type": "finder"
                },
                {
                    "lang": "en",
                    "value": "Shinya Murakami (@4n86rakam1)",
                    "type": "finder"
                },
                {
                    "lang": "en",
                    "value": "Calvin (@calbebop)",
                    "type": "finder"
                },
                {
                    "lang": "en",
                    "value": "Patryk Gruszka (@patrykgruszka)",
                    "type": "remediation developer"
                },
                {
                    "lang": "en",
                    "value": "John Linhart (@escopecz)",
                    "type": "remediation reviewer"
                },
                {
                    "lang": "en",
                    "value": "Leuchtfeuer Digital Marketing (@Leuchtfeuer)",
                    "type": "sponsor"
                }
            ],
            "source": {
                "advisory": "GHSA-mxjf-pghx-h299",
                "discovery": "UNKNOWN"
            },
            "x_generator": {
                "engine": "Vulnogram 1.0.2"
            }
        }
    }
}