Mautic Asset API CVE-2026-115194

Requires an authenticated Mautic API account that holds permission to create assets, and the Asset API must be enabled/reachable. The attacker creates a local asset whose supplied file path is not constrained to the asset upload directory, then publishes it so its public download URL serves the target file; any file readable by the web server user (notably Mautic's local configuration containing DB password, secret key, and SMTP credentials) can be exfiltrated. Limiting factors: the PR:L authentication-plus-asset-creation-permission gate, and that the leaked download URL must then be requested (though that final retrieval is unauthenticated and public). The vendor states there are no official workarounds; interim mitigations are to disable API access or restrict asset-creation permission to trusted administrators and to review existing local assets for paths outside the upload directory - upgrading is the only complete fix.

This is a moderate-priority issue whose real-world risk is shaped more by access prerequisites than by raw impact. The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) is internally consistent with the description: the attack is network-reachable (AV:N) through the Asset API, low-complexity (AC:L), and requires a low-privilege authenticated account with asset-creation permission (PR:L), with high confidentiality impact (C:H) and no integrity or availability impact. The PR:L requirement is the dominant limiting factor - this is not an unauthenticated flaw, so it favors insiders or attackers who have already obtained valid API credentials. Exploitation status is 'no public exploit identified at time of analysis': the only reference is the vendor GHSA advisory, not a PoC or exploit, and there is no KEV listing. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The vuln.today decision label is 'this_month', consistent with a serious-but-not-emergency bug: credential disclosure is severe (leaked DB password, secret key, SMTP credentials can enable follow-on compromise and lateral movement), but the authentication gate keeps it below drop-everything urgency. Net: a genuine credential-exposure risk warranting scheduled patching within the maintenance window rather than an emergency, with the caveat that any environment where API access is broadly granted raises the effective risk materially.

An attacker holding a low-privilege Mautic account with asset-creation permission calls the Asset API to create a local asset whose file path points outside the upload directory (e.g. the Mautic local configuration file), then publishes the asset. The resulting public download URL serves that file's contents without authentication, exposing the database password, secret key, and SMTP credentials to anyone who has the URL. No public exploit code is identified at time of analysis; the only reference is the vendor advisory.