A path traversal flaw in the Mautic Asset API enables an authenticated API user to register any file that the web server can read as an asset. When the asset is published, its public download URL serves the file’s contents without authentication, allowing read‑only access to arbitrary server files. This exposure includes configuration files that store database passwords, secret keys, and mail credentials, and can reveal other sensitive data.The defect originates from insufficient path validation, a classic directory traversal weakness (CWE‑22).

The vulnerability affects installations of the Mautic marketing automation platform utilizing the Asset API. No specific version numbers are listed, so any deployment exposing the API and permitting asset creation via authenticated calls is potentially impacted.

With a CVSS score of 6.5 the risk is considered medium. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an authenticated API user who has permission to create assets; the attacker must be able to predict or inject a desired file path. Once a valid asset is created, anyone holding the public URL can retrieve the file, enabling disclosure of credentials and other sensitive information. Due to the lack of an existing public exploit, exploitation remains dependent on the attacker’s ability to obtain the necessary API credentials and the required permissions, but the impact of a successful ad‑hoc exploitation is significant, granting exposure of critical configuration data.