CVE-2026-9559: Critical Path Traversal in Mautic Campaign Import Enables RCE

What's the vulnerability?

CVE-2026-9559 is a critical path traversal flaw (CWE-22, CWE-73, CWE-98) in Mautic core's Campaign Import feature, rated CVSS 9.9. The root cause is insufficient sanitization of file paths and archive entries supplied during campaign import: an attacker can embed ../ sequences in a CSV or ZIP payload, causing Mautic to write files outside the intended media/import directory. Because Mautic will happily follow attacker-controlled paths during extraction/import, this can be abused to drop a webshell into a web-accessible directory, leading to arbitrary file write and ultimately remote code execution on the host.

Affected software

• Product: mautic/core (Composer package)
• Vendor: Composer/Mautic
• Affected versions: >= 7.0.0, < 7.1.2

No patch date is recorded in our tracking yet, so any instance running an in-range version should be treated as vulnerable until upgraded.

Exploitation status

A public proof-of-concept is available (GHSA-6r9h-4h75-7q4x), placing this in poc-public status. This is not yet confirmed as actively exploited in the wild (not KEV-listed), but the combination of a public PoC, unauthenticated/low-privilege attack surface, and a direct path to RCE makes weaponization highly likely in the near term. Defenders running affected Mautic versions should prioritize patching and treat this as an urgent, high-confidence target for opportunistic scanning and exploitation.

How our detection catches it

We ship coverage for this technique across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL). At a high level, the logic looks for:

• Campaign import requests carrying suspicious multipart upload content, including path traversal sequences (../) or archive entries with anomalous internal paths.
• File write activity occurring outside Mautic's expected media/import directory structure, indicating a successful traversal write.
• Follow-on execution behavior consistent with a dropped webshell (e.g., unexpected process spawns or web requests to newly written files) that correlates back to the initial import request.

Correlating the upload-time indicators with post-write file activity lets analysts distinguish a legitimate campaign import from an exploitation attempt, and catch cases where the traversal payload succeeds even if the initial request looks superficially benign.

Get the full detection

For the complete KQL, SPL, and other SIEM queries, MITRE ATT&CK mapping, and response guidance, see the full detection page: CVE-2026-9559 — Mautic Campaign Import Path Traversal.