Path traversal in Mautic Asset API lets attackers read server files
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Mautic core from 2.3.0 before 5.2.12, from 6.0.0 before 6.0.10, and from 7.0.0 before 7.2.2 contains a path traversal flaw in the Asset API. The API does not restrict the file path supplied when creating a local asset to the asset upload directory. An authenticated API user with permission to create assets can register any file readable by the web server, and its public download URL then serves that file's contents without authentication. Attackers can thereby read configuration files containing database passwords, secret keys and SMTP credentials.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API user with permission to create assets can register any file that is readable by the web server process as a Mautic asset. When the asset is published, its public download URL serves the contents of that file without authentication. This allows the attacker to read arbitrary files from the server, including Mautic configuration files containing the database password, secret key, and mail (SMTP) credentials, as well as system files and any other file readable by the web server user. Exposed credentials can be used to access the database or other connected services, and anyone with the public asset URL can retrieve the file contents.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | mautic/core | 2.3.0 to before 5.2.12; 6.0.0 to before 6.0.10; 7.0.0 to before 7.2.2 | 5.2.12, 6.0.10, 7.2.2 | Patch available | CNA |
- mautic/core Vendor— Affected 2.3.0 to before 5.2.12; 6.0.0 to before 6.0.10; 7.0.0 to before 7.2.2 Fixed in 5.2.12, 6.0.10, 7.2.2 Patch available CNA
Remediation
Upgrade mautic/core to 5.2.12, 6.0.10 or 7.2.2, depending on the release line in use.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA mautic/core Fixed in 5.2.12, 6.0.10, 7.2.2
Timeline
- 2026-10-26 Threatist record created from CVE-2026-115194
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-26 Priority changed: MEDIUM → LOW
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences