Mautic fixes a critical campaign-import flaw and two SQL injections

Mautic fixes a critical campaign-import flaw and two SQL injections

26 October 2026: Mautic, the open-source marketing automation platform, has released 7.2.2, 6.0.10 and 5.2.12 to fix nine vulnerabilities, CVE-2026-115188 to CVE-2026-115196. The most serious is a critical remote code execution flaw in campaign import that affects only the 7.x line: a user who is allowed to import campaigns, not necessarily an administrator, can place a script file in the public media directory and run it.

Not yet independently verified. The advisories are Mautic's own. We saw a tagged 7.2.2 release but have not yet seen 6.0.10 and 5.2.12 on the releases page; those versions come from the advisories' patched-version fields. We will update this when it can be confirmed, and remove this note.

The project published its advisories on 26 October and asks administrators to update "at your earliest convenience after performing a full backup". None of them mentions exploitation.

The campaign-import flaw in 7.x

Importing a campaign copies the asset files bundled with it into a public media folder without restricting their names or types (CVE-2026-115188). That works through the user interface and through the /api/campaigns/import endpoint. The advisory says the default Apache set-up of the official Docker image honours per-directory configuration, so the flaw leads to code execution there. Mautic 6, 5 and 4 do not have the vulnerable code.

There is no official workaround. Mautic suggests two mitigations until the update is installed: take the campaign-import create permission away from everyone but trusted administrators, and stop the web server executing scripts in the media/ directory.

The rest of the batch

Two high-rated flaws reach back many years and are fixed in all three supported lines:

• CVE-2026-115189: an escape from the Twig sandbox in theme templates, because an earlier fix did not enforce every restriction; affects versions from 1.3.0
• CVE-2026-115191: SQL injection through a field-selector parameter in the contact lookup endpoint; affects versions from 2.1.0

The release notes add a SQL injection in the dashboard widget API (CVE-2026-115192), stored cross-site scripting in HTML custom contact fields (CVE-2026-115193), arbitrary file reads through path traversal in the asset API (CVE-2026-115194), broken access control in the stats API (CVE-2026-115195) and an open redirect after form submission (CVE-2026-115196).

Which version to install

• 7.x: 7.2.2
• 6.x: 6.0.10
• 5.x: 5.2.12

Older lines are not covered. Many credited researchers reported the same issues in parallel, according to the advisories, which tends to mean the code paths are well known.

Our marketing automation software category lists 8 products; Mautic is not yet among them. Hosts that run Mautic for clients should look first at who holds the campaign-import permission, since that permission is the only thing standing between an ordinary account and the server on 7.x.

Related on TrustList:

• Salesforce agrees to buy Braze for about $5.66bn in cash
• Twilio limits US message throughput from 19 November 2026 to 4 January 2027: plan peak-season SMS now

Sources

• Mautic: security advisory GHSA-mxjf-pghx-h299 (CVE-2026-115188), remote code execution in campaign import, 26 October 2026
• Mautic: security advisory GHSA-h7pm-79gc-8867 (CVE-2026-115189), Twig sandbox escape in theme templates, 26 October 2026
• Mautic: security advisory GHSA-fj8v-c9c3-7q26 (CVE-2026-115191), SQL injection in contact lookup, 26 October 2026
• Mautic 7.2.2 release notes, 26 October 2026