What is the CVSS score of CVE-2026-9559?

CVE-2026-9559 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Mautic are affected by CVE-2026-9559?

Mautic 7 contains a critical remote code execution vulnerability (CVE-2026-9559) affecting authenticated users with campaign import permissions, allowing arbitrary PHP file deployment on the web…. A patch is available.

How to fix or mitigate CVE-2026-9559?

Within 24 hours: Inventory all Mautic 7 instances; audit and revoke campaign:imports:create permission from all non-essential accounts, restricting to administrative personnel only. Within 7 days: Enable detailed logging on all campaign import uploads and modifications to cache/configuration directories; implement file integrity monitoring (FIM) on PHP application files; deploy network segmentation to limit web server lateral movement. Within 30 days: Monitor vendor advisories for Mautic patched version release; develop and validate upgrade testing plan; consider temporary disablement of campaign import feature if operationally feasible.

Mautic CVE-2026-9559

EUVD-2026-33277 CRITICAL

Path Traversal (CWE-22)

2026-05-29 Mautic

GHSA-6r9h-4h75-7q4x

RCE PHP Path Traversal

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:21 vuln.today

DescriptionCVE.org

A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges (campaign:imports:create) can write arbitrary PHP files to sensitive system directories. An attacker can exploit this to overwrite critical internal configuration or cache components, resulting in Remote Code Execution (RCE) under the context of the web server user.

AnalysisAI

Remote code execution in Mautic 7 allows authenticated users with the campaign:imports:create permission to write arbitrary PHP files outside the intended extraction directory via a malicious ZIP uploaded through the campaign import feature. The flaw is a path traversal in the ZIP extraction routine that can be leveraged to overwrite cache or configuration files, yielding code execution as the web server user. No public exploit identified at time of analysis, and the CVSS 9.9 score reflects the combination of low attack complexity, scope change, and full CIA impact.

Technical ContextAI

Mautic is an open-source PHP-based marketing automation platform. The campaign import feature accepts a ZIP archive and extracts it into a temporary working directory before processing the contained campaign definitions. The underlying weakness is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as 'Zip Slip' when it occurs in archive extraction: entries inside the ZIP that contain '../' sequences or absolute paths are not normalized or constrained to the intended target directory, allowing the extractor to write files anywhere the PHP process has filesystem permissions. Because Mautic is PHP, dropping a .php file into a web-served directory or overwriting an autoloaded/cached file (such as a compiled Symfony container or Twig cache) is sufficient to achieve code execution on the next request.

Affected ProductsAI

Mautic 7 is affected, as documented in the upstream GitHub Security Advisory at https://github.com/mautic/mautic/security/advisories/GHSA-6r9h-4h75-7q4x. No CPE strings were supplied in the input intelligence, so the exact lower and upper version bounds within the 7.x line are not independently confirmed here - administrators should consult the linked advisory for the precise vulnerable version range and any backports to prior major versions.

RemediationAI

Upgrade to the fixed Mautic 7 release identified in the vendor advisory at https://github.com/mautic/mautic/security/advisories/GHSA-6r9h-4h75-7q4x; the exact fixed version was not provided in the input data, so consult that advisory directly rather than relying on inferred version numbers. As compensating controls until patching, revoke the campaign:imports:create permission from all non-administrative roles so only fully trusted operators can invoke the vulnerable import path (trade-off: marketing users lose self-service campaign import), place the Mautic administrative UI behind an authenticated reverse-proxy or IP allowlist to reduce the population of attackers able to reach the endpoint (trade-off: complicates legitimate remote access), and tighten the web server user's write permissions on cache, config, and document-root directories where feasible (trade-off: may break Mautic features that legitimately write to those paths, so test in staging). Monitor application logs for campaign import events and the filesystem for unexpected .php files appearing under cache or public directories.