Detect Mautic Campaign Import Path Traversal (CVE-2026-9559) in Google Chronicle
Detects exploitation attempts against CVE-2026-9559, a critical path traversal vulnerability (CVSS 9.9) in Mautic core's Campaign Import feature affecting versions >=7.0.0, <7.1.2. An unauthenticated or low-privileged attacker can craft a malicious campaign import file (CSV/ZIP) containing path traversal sequences (../) or archive entries that write files outside the intended import directory, potentially achieving arbitrary file write and remote code execution via webshell placement. A public PoC exists (GHSA-6r9h-4h75-7q4x). This detection identifies suspicious campaign import requests, path traversal payloads in multipart uploads, unexpected file writes outside Mautic's media/import directories, and subsequent webshell execution.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
YARA-L Detection Query
rule mautic_campaign_import_path_traversal_cve_2026_9559 {
meta:
author = "detection-engineering"
description = "Detects path traversal attempts against Mautic campaign import (CVE-2026-9559)"
severity = "CRITICAL"
cve = "CVE-2026-9559"
events:
$e.metadata.event_type = "NETWORK_HTTP"
$e.network.http.method = "POST"
(re.regex($e.target.url, `(?i)campaigns/(import|batch)`) or re.regex($e.target.url, `(?i)api/campaigns/import`))
re.regex($e.target.url, `(?i)(\.\.%2f|\.\.%5c|%2e%2e%2f|%252e%252e%252f|\.\./\.\./)`)
outcome:
$risk_score = max(85)
$src_ip = array_distinct($e.principal.ip)
$target_url = array_distinct($e.target.url)
condition:
$e
}Chronicle YARA-L rule matching HTTP POST requests to Mautic campaign import endpoints that include path traversal sequences, indicating CVE-2026-9559 exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate encoded characters in unrelated marketing campaign import filenames
- Authorized red team or bug bounty testing against the endpoint
- Web application firewall re-encoding requests before logging
Other platforms for CVE-2026-9559
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Path Traversal Campaign Import POST (Linux)
Expected signal: HTTP POST log entry to /s/campaigns/import with URL/multipart filename containing '../' sequences; potential file creation event for shell.php outside the intended import directory.
- Test 2Verify Unauthorized File Write Outside Import Directory (Linux)
Expected signal: File creation/modification event logged by EDR/FIM for a PHP file outside the intended import directory.
- Test 3Simulate Campaign Import Traversal via ZIP Archive (Windows)
Expected signal: IIS W3C log entry for POST to /s/campaigns/import with an unusual multipart body size; potential unauthorized file write event under C:\inetpub\wwwroot outside media\files\import.
- Test 4Validate Mautic Version Vulnerability Check (macOS)
Expected signal: No network telemetry generated; local file read only.
Response Playbook
Triage
- Identify all source IPs that issued POST requests to /s/campaigns/import, /s/campaigns/batch, or /api/campaigns/import containing path traversal sequences (../, %2e%2e%2f) within the last 30 days.
- Confirm the affected Mautic instance version via /s/public or composer.lock; validate it falls within the vulnerable range (>= 7.0.0, < 7.1.2).
- Inspect the Mautic media/files/import directory and web root for unexpected files (e.g., .php, .phtml, .jsp) written outside the expected import path, indicating successful traversal.
- Review Mautic application logs (app/logs/mautic_prod.log) for import job errors or exceptions referencing unusual file paths.
- Check for newly created or modified files with recent timestamps in web-accessible directories that correlate with the suspicious import requests.
Containment
- Immediately upgrade Mautic to version 7.1.2 or later, or apply the vendor patch referenced in GHSA-6r9h-4h75-7q4x.
- If patching is not immediately possible, disable the campaign import feature or restrict access to /s/campaigns/import and /api/campaigns/import via WAF rules blocking path traversal patterns (../, %2e%2e%2f, %5c) and non-admin roles.
- Quarantine or remove any webshells or unauthorized files discovered outside the intended import directory, preserving copies for forensic analysis before deletion.
- Rotate any credentials or API keys that may have been exposed if a webshell achieved code execution on the host.
- Place the affected instance behind additional network segmentation/allow-listing while remediation is verified.
Evidence Collection
- Preserve web server access logs, Mautic application logs, and any WAF/proxy logs covering the suspected exploitation window.
- Capture a forensic copy (hash and archive) of any anomalous files found in the web root, media/files/import directory, or temp upload paths before remediation.
- Export the full HTTP request/response bodies of the suspicious campaign import submissions, including uploaded CSV/ZIP payloads, for malware/static analysis.
- Document the Mautic version, PHP version, and server file permissions at time of incident to support the vulnerability timeline.
Escalation Criteria
- !Escalate to incident response if any file write occurred outside the designated import directory or if a webshell/backdoor is confirmed on the host.
- !Escalate if evidence shows successful remote code execution (e.g., outbound connections from the Mautic host, unexpected process spawns from php-fpm/apache, or new scheduled tasks/cron entries).
- !Escalate if the Mautic instance handles sensitive customer PII/marketing data and evidence suggests data exfiltration alongside the traversal attempt.
- !Escalate if multiple internet-facing Mautic instances across the organization show the same exploitation pattern, suggesting mass scanning or targeted campaign.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Unexpected .php/.phtml/.jsp files present in Mautic web root, media/files/import, or other web-accessible directories outside the intended import path - >
Mautic application log entries (app/logs/mautic_prod.log, mautic_prod.php) referencing import job failures, file path errors, or unusual filenames with traversal sequences - >
Web server access logs showing POST requests to campaign import endpoints with encoded ../ sequences and abnormal response codes (200/500) from unfamiliar source IPs - >
File system timestamps (ctime/mtime) on web root files that are inconsistent with the last known legitimate deployment/patch date
Tuning Guidance
Tune false positives by validating the source IP reputation and confirming whether the requesting account has legitimate marketer/admin privileges to use campaign import features; legitimate automation or scheduled data migrations should be allow-listed by service account identity. Narrow matching to only the vulnerable Mautic version range where possible by correlating with asset inventory data, and increase severity when traversal sequences are followed by file writes outside media/files/import within a short time window (high-confidence indicator of successful exploitation).
Hunting Queries
Broad hunting query to surface any campaign import traffic containing traversal-like sequences over a wider historical window, for identifying low-and-slow or previously missed exploitation attempts.
W3CIISLog
| where cs_uri_stem has "campaigns/import"
| extend Decoded = url_decode(cs_uri_query)
| where Decoded has ".."
| summarize count() by c_ip, cs_uri_stem, bin(TimeGenerated, 1h)index=web (uri_path="*campaigns/import*")
| eval decoded=urldecode(uri_query)
| regex decoded="\.\."
| stats count by src_ip, uri_path, _timeAtomic Red Team Tests
Sends a crafted multipart POST request to a lab Mautic instance's campaign import endpoint containing a path traversal filename to validate detection of CVE-2026-9559 exploitation attempts.
Command
curl -s -X POST 'http://lab-mautic.local/s/campaigns/import' -H 'Cookie: mautic_session=<lab_session>' -F '[email protected];filename=../../../../var/www/html/media/files/shell.php'Cleanup
rm -f payload.csv; verify and remove any file written to /var/www/html/media/files/shell.php on the lab instance if traversal succeeded.Expected Telemetry
HTTP POST log entry to /s/campaigns/import with URL/multipart filename containing '../' sequences; potential file creation event for shell.php outside the intended import directory.
Expected Detection
KQL and SPL rules should trigger on the POST request containing traversal sequences to the campaign import endpoint.
Checks whether a file was written outside the expected Mautic media/files/import directory following a simulated traversal import, mimicking post-exploitation webshell placement.
Command
find /var/www/html -maxdepth 4 -newer /tmp/baseline_timestamp -type f \( -name '*.php' -o -name '*.phtml' \) ! -path '*/media/files/import/*'Cleanup
Remove any test files created during the exercise and restore baseline timestamp file if used for comparison.Expected Telemetry
File creation/modification event logged by EDR/FIM for a PHP file outside the intended import directory.
Expected Detection
Elastic EQL sequence rule correlating the traversal POST request with the subsequent file write should fire.
Uploads a ZIP archive containing a path-traversal entry (zip-slip style) to a lab Mautic instance running on Windows/IIS to validate detection of archive-based traversal exploitation of CVE-2026-9559.
Command
Invoke-WebRequest -Uri 'http://lab-mautic.local/s/campaigns/import' -Method POST -Headers @{Cookie='mautic_session=<lab_session>'} -Form @{file=Get-Item '.\traversal_payload.zip'}Cleanup
Remove traversal_payload.zip from disk and delete any file extracted outside the designated import folder on the lab web root (e.g., C:\inetpub\wwwroot\media\files\).Expected Telemetry
IIS W3C log entry for POST to /s/campaigns/import with an unusual multipart body size; potential unauthorized file write event under C:\inetpub\wwwroot outside media\files\import.
Expected Detection
KQL query against W3CIISLog should flag the POST request; file integrity monitoring should flag the out-of-path file write.
Confirms whether a local/lab Mautic installation's composer.lock version falls within the vulnerable range for CVE-2026-9559, supporting triage decisions before running exploitation tests.
Command
grep -A2 '"name": "mautic/core"' /path/to/mautic/composer.lock | grep versionCleanup
No cleanup required; read-only version check.Expected Telemetry
No network telemetry generated; local file read only.
Expected Detection
Not applicable — this is a preparatory version-confirmation test, not an exploitation attempt; used to scope whether further detection validation tests are relevant.