{"api_version":"1","generated_at":"2026-10-27T08:35:18+00:00","cve":"CVE-2026-115188","urls":{"html":"https://cve.report/CVE-2026-115188","api":"https://cve.report/api/cve/CVE-2026-115188.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-115188","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-115188"},"summary":{"title":"CVE-2026-115188","description":"An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.","state":"PUBLISHED","assigner":"Mautic","published_at":"2026-10-26 14:16:30","updated_at":"2026-10-26 16:17:16"},"problem_types":["CWE-94","CWE-434","CWE-434 CWE-434 Unrestricted Upload of File with Dangerous Type","CWE-94 CWE-94 Improper Control of Generation of Code ('Code Injection')"],"metrics":[{"version":"3.1","source":"security@mautic.org","type":"Secondary","score":"9.9","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"9.9","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://github.com/mautic/mautic/security/advisories/GHSA-mxjf-pghx-h299","name":"https://github.com/mautic/mautic/security/advisories/GHSA-mxjf-pghx-h299","refsource":"security@mautic.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115188","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115188","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"There are no official workarounds. To mitigate this vulnerability without upgrading, remove the campaign import create permission from all users who do not strictly need it and restrict it to trusted administrators, and configure the web server at server or virtual-host level, so that it cannot be overridden by files in the application directory, to deny script execution in the media/ directory.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Moath Aloufi (@m0xath)","lang":"en"},{"source":"CNA","value":"@iys8","lang":"en"},{"source":"CNA","value":"David Carliez (@DavidCarliez)","lang":"en"},{"source":"CNA","value":"@Forrof","lang":"en"},{"source":"CNA","value":"@sdrk3nD","lang":"en"},{"source":"CNA","value":"@Hama1cco","lang":"en"},{"source":"CNA","value":"Shinya Murakami (@4n86rakam1)","lang":"en"},{"source":"CNA","value":"Calvin (@calbebop)","lang":"en"},{"source":"CNA","value":"Patryk Gruszka (@patrykgruszka)","lang":"en"},{"source":"CNA","value":"John Linhart (@escopecz)","lang":"en"},{"source":"CNA","value":"Leuchtfeuer Digital Marketing (@Leuchtfeuer)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-115188","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-26T14:47:17.335563Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-26T15:35:53.849Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://packagist.org","defaultStatus":"unaffected","packageName":"mautic/core","repo":"https://github.com/mautic/mautic","versions":[{"lessThan":"7.2.2","status":"affected","version":"7.0.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Moath Aloufi (@m0xath)"},{"lang":"en","type":"finder","value":"@iys8"},{"lang":"en","type":"finder","value":"David Carliez (@DavidCarliez)"},{"lang":"en","type":"finder","value":"@Forrof"},{"lang":"en","type":"finder","value":"@sdrk3nD"},{"lang":"en","type":"finder","value":"@Hama1cco"},{"lang":"en","type":"finder","value":"Shinya Murakami (@4n86rakam1)"},{"lang":"en","type":"finder","value":"Calvin (@calbebop)"},{"lang":"en","type":"remediation developer","value":"Patryk Gruszka (@patrykgruszka)"},{"lang":"en","type":"remediation reviewer","value":"John Linhart (@escopecz)"},{"lang":"en","type":"sponsor","value":"Leuchtfeuer Digital Marketing (@Leuchtfeuer)"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data."}],"value":"An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data."}],"impacts":[{"capecId":"CAPEC-650","descriptions":[{"lang":"en","value":"CAPEC-650 Upload a Web Shell to a Web Server"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"},{"cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-26T12:36:35.943Z","orgId":"4e531c38-7a33-45d3-98dd-d909c0d8852e","shortName":"Mautic"},"references":[{"url":"https://github.com/mautic/mautic/security/advisories/GHSA-mxjf-pghx-h299"}],"source":{"advisory":"GHSA-mxjf-pghx-h299","discovery":"UNKNOWN"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"There are no official workarounds. To mitigate this vulnerability without upgrading, remove the campaign import create permission from all users who do not strictly need it and restrict it to trusted administrators, and configure the web server at server or virtual-host level, so that it cannot be overridden by files in the application directory, to deny script execution in the media/ directory."}],"value":"There are no official workarounds. To mitigate this vulnerability without upgrading, remove the campaign import create permission from all users who do not strictly need it and restrict it to trusted administrators, and configure the web server at server or virtual-host level, so that it cannot be overridden by files in the application directory, to deny script execution in the media/ directory."}],"x_generator":{"engine":"Vulnogram 1.0.2"}}},"cveMetadata":{"assignerOrgId":"4e531c38-7a33-45d3-98dd-d909c0d8852e","assignerShortName":"Mautic","cveId":"CVE-2026-115188","datePublished":"2026-10-26T12:33:54.469Z","dateReserved":"2026-10-22T06:39:08.913Z","dateUpdated":"2026-10-26T15:35:53.849Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-26 14:16:30","lastModifiedDate":"2026-10-26 16:17:16","problem_types":["CWE-94","CWE-434","CWE-434 CWE-434 Unrestricted Upload of File with Dangerous Type","CWE-94 CWE-94 Improper Control of Generation of Code ('Code Injection')"],"metrics":{"cvssMetricV31":[{"source":"security@mautic.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-26T14:47:17.335563Z","id":"CVE-2026-115188","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"115188","Ordinal":"1","Title":"CVE-2026-115188","CVE":"CVE-2026-115188","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"115188","Ordinal":"1","NoteData":"An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.","Type":"Description","Title":"CVE-2026-115188"}]}}}