Mautic 7 EUVD-2026-109791

Requires an authenticated Mautic 7 account (versions >= 7.0.0 and < 7.2.2) whose user holds the campaign-import create permission; administrator rights are explicitly NOT required, and exploitation works through either the web UI or the /api/campaigns/import API endpoint. The trigger is uploading a campaign archive whose bundled asset files are copied into the publicly accessible media directory without filename or type restriction. The decisive limiting factor for full remote code execution is deployment-specific: the web server must honor per-directory configuration and execute scripts from the media/ directory - this is the case for the default Apache setup of the official Mautic Docker image. On deployments where the web server does not execute scripts from the media directory, impact is limited to writing arbitrary files into a publicly accessible web directory rather than code execution.

This is a genuine high-priority issue, and the signals are mostly consistent rather than conflicting. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes a network-reachable, low-complexity flaw requiring only low privileges (a Mautic user holding the campaign-import create permission - not administrator) with no user interaction, and a scope change reflecting that file writes into the web root escalate from application context to code execution in the web-server context. The vuln.today decision label is act_now, which aligns with the critical CVSS and the vendor's own 'Remote Code Execution' framing. Note the signals that are MISSING rather than conflicting: no EPSS score is provided, and there is no CISA KEV listing in the input, so there is no evidence of active exploitation - treat this as an urgent-to-patch flaw, not a confirmed in-the-wild campaign. There is also no PoC or exploit reference in the input (the only reference is the GHSA advisory itself), so no public exploit code is established. The one real caveat the evidence itself states is conditionality: full RCE depends on the web server honoring per-directory configuration and executing scripts from the media directory (as in the official Apache-based Docker image); where it does not, impact is reduced to arbitrary file write into a public directory, which the vendor-assigned C:H/I:H/A:H does not separately reflect.

An authenticated Mautic 7 user who holds the campaign-import create permission (not an admin) crafts a campaign archive whose bundled asset files include a server-side script with an attacker-chosen name and type, then submits it via the UI or the /api/campaigns/import endpoint. Mautic copies the asset into the publicly accessible media directory without filename or type restriction; on an Apache deployment that honors per-directory config (e.g. the official Mautic Docker image), the attacker requests the planted script and achieves code execution as the web-server user. No public exploit code is identified in the provided data.