CVE-2026-115188

Summary

An authenticated user with campaign import permissions can upload a malicious archive that places arbitrary files—including server-side scripts—into Mautic’s publicly accessible media directory, leading to remote code execution on Apache servers that honor .htaccess, granting the web server user full access to application secrets and data.

Exploitability

Exploitation requires only low-privilege authentication (campaign creation permission) and no user interaction; the API endpoint /api/campaigns/import or UI import feature can be abused directly.

Blast radius

Successful exploitation yields web-server-level RCE, enabling full compromise of Mautic configuration files, secrets, and sensitive contact data stored in the application’s database.

Detection

Look for unexpected executable files (e.g., .php, .phtml) appearing in the publicly accessible media directory (e.g., /media/), especially with non-standard names or timestamps coinciding with campaign import API calls or UI activity; Apache error logs may show execution attempts of newly uploaded scripts.

Prioritized remediation

Upgrade to Mautic 7.0.1 or later, which restricts file types and sanitizes uploaded archive contents during campaign import.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.