Path Traversal Vulnerability in Mautic Campaign Import Feature

CVE-2026-9559

What is CVE-2026-9559?

In Mautic version 7, the campaign import feature contains a critical path traversal vulnerability. This flaw occurs during the extraction of uploaded ZIP files, where inadequate validation allows file paths to escape designated temporary directories. An authenticated user granted campaign import privileges can exploit this vulnerability to write arbitrary PHP files to sensitive system directories. Successful exploitation could lead to the overwriting of critical internal configuration files or cache components, potentially allowing remote code execution within the context of the web server user, posing significant security risks.

References