CVE-2026-9559: Path Traversal
Summary A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories.
Impact An authenticated user with campaign import privileges (campaign:imports:create) can write arbitrary PHP files to sensitive system directories. An attacker can exploit this to overwrite critical internal configuration or cache components, resulting in Remote Code Execution (RCE) under the context of the web server user.
Patched Versions This security issue has been addressed in the following release: 7.1.2
Note: Mautic 6.x, 5.x, and 4.x branches are not affected by this vulnerability. For general security support regarding legacy Mautic 4 releases, please refer to the ELTS page.
Workarounds There are no official workarounds. To mitigate this risk without upgrading, revoke campaign import permissions (campaign:imports:create) from non-administrative users.
Other sources
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges (campaign:imports:create) can write arbitrary PHP files to sensitive system directories. An attacker can exploit this to overwrite critical internal configuration or cache components, resulting in Remote Code Execution (RCE) under the context of the web server user.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mautic/coreto a version that resolves this vulnerability.Fixed in 7.1.2 - Upgrade
Upgrade
mauticto a version that resolves this vulnerability.Fixed in 7.1.2 - Compensating control
Revoke the campaign import permission `campaign:imports:create` from non-administrative users to mitigate the path traversal leading to arbitrary PHP file writes and RCE in Mautic 7.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9559?
The severity of CVE-2026-9559 is rated as critical with a score of 9.9.
How do I fix CVE-2026-9559?
To fix CVE-2026-9559, ensure that you update to the latest version of Mautic where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-9559?
CVE-2026-9559 is a path traversal vulnerability that allows an authenticated user to access restricted file paths.
Who is affected by CVE-2026-9559?
CVE-2026-9559 affects authenticated users with campaign import privileges in Mautic 7.
What impact does CVE-2026-9559 have on systems?
CVE-2026-9559 potentially allows attackers to execute malicious files or scripts on the server by exploiting the path traversal vulnerability.