An unrestricted file upload vulnerability in the campaign import feature of Mautic allows an authenticated user with create campaign import permission to upload arbitrary files, including server‑side scripts, into the publicly accessible media directory. The application copies these files without validating names or types, enabling an attacker to place malicious payloads in the web root. Because the upload occurs through the user interface or the /api/campaigns/import endpoint, administrator privileges are not required. If the web server honours per‑directory configuration, the attacker can execute the uploaded script with the privileges of the web server user, thereby gaining access to the Mautic configuration, application secrets, and contact data.

Mautic 7, the open‑source marketing automation platform. The vulnerability manifests in the campaign import functionality and accepts files through the campaign import API endpoint and UI for any user who has create import rights.

The CVSS base score of 9.9 classifies this flaw as critical, and the EPSS score is not available, indicating either a lack of data or a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers need only an authenticated session with campaign‑import create permission, which is not reserved for administrators, making the attack vector highly practical. Successful exploitation results in remote code execution and full read/write access to sensitive application data.