# CVE-2026-9559: Mautic path traversal in campaign import feature

Source: https://junglewise.ai/threats/cve-2026-9559-mautic-path-traversal-in-campaign-import-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-9559 · Severity: critical · CVSS 9.9 · Published 2026-05-29

Mautic, an open-source marketing automation platform, is affected by a security flaw in its campaign import feature. An authorized user could upload a specially crafted file that bypasses security restrictions to place malicious code on the server. If exploited, this allows an attacker to take full control of the system, potentially leading to data theft, service disruption, or unauthorized access to customer marketing data.

Technologies: [Mautic Core](https://junglewise.ai/threats/technologies/mautic-core), [mautic/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-mautic-core). Vendors: [Mautic](https://junglewise.ai/threats/vendors/mautic), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-9559 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9559 being exploited in the wild.

**How severe is CVE-2026-9559?** Critical severity, with a CVSS score of 9.9, published 29 May 2026.

**Which products and versions are affected?** Mautic Core >= 7.0, < 7.1.2, >= 7.0.0, < 7.1.2; mautic/core (Packagist) ECOSYSTEM:introduced=7.0.0,fixed=7.1.2.

**Is there a fix for CVE-2026-9559?** Yes. mautic/core (Packagist): upgrade to 7.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9559 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9559?** Check whether you run Mautic Core or mautic/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mautic/core (Packagist): upgrade to 7.1.2 or later

  ```sh
  composer require mautic/core:^7.1.2
  ```


## Technical details

A path traversal vulnerability (CWE-22) exists in Mautic 7.x within the campaign import functionality. The root cause is a flaw in the validation logic when extracting uploaded ZIP files, which fails to prevent file paths from escaping the intended temporary directory. An authenticated attacker with 'campaign:imports:create' privileges can exploit this to write arbitrary PHP files to sensitive system directories, such as configuration or cache folders. This leads to Remote Code Execution (RCE) under the context of the web server user. The issue is patched in version 7.1.2.

## Affected products

- Mautic Mautic Core >= 7.0.0, < 7.1.2

## Identifiers

- CVE-2026-9559
- GHSA-6r9h-4h75-7q4x

## Timeline

- 2026-05-29: disclosed: NVD publication date
- 2026-07-02: advisory: GitHub Advisory published
- 2026-07-02: patched: Version 7.1.2 released

## References

- [https://api.github.com/users/nglong05](https://api.github.com/users/nglong05)
- [https://github.com/nglong05](https://github.com/nglong05)
- [https://api.github.com/users/nglong05/gists%7B/gist_id%7D](https://api.github.com/users/nglong05/gists%7B/gist_id%7D)
- [https://api.github.com/users/nglong05/repos](https://api.github.com/users/nglong05/repos)
- [https://avatars.githubusercontent.com/u/97835569?v=4](https://avatars.githubusercontent.com/u/97835569?v=4)
- [https://api.github.com/users/nglong05/events%7B/privacy%7D](https://api.github.com/users/nglong05/events%7B/privacy%7D)

## Related threats

- [Mautic Asset API path traversal vulnerability](https://junglewise.ai/threats/cve-2026-115194-a-path-traversal-vulnerability-exists-in-the-mautic-asset-api)
- [Mautic Twig sandbox escape in theme templates](https://junglewise.ai/threats/cve-2026-115189-a-server-side-template-injection-vulnerability-exists-in-the)
- [Mautic stored XSS in project selector component](https://junglewise.ai/threats/cve-2026-9811-mautic-stored-xss-in-project-selector-component)
- [Mautic stored XSS in Projects component project tags](https://junglewise.ai/threats/cve-2026-9809-mautic-stored-xss-in-projects-component-project-tags)
- [Mautic Core authorization bypass in API v2 endpoints](https://junglewise.ai/threats/cve-2026-9808-mautic-core-authorization-bypass-in-api-v2-endpoints)