Mautic 7.2.2 fixes nine flaws, including critical RCE

Mautic has released security updates as of 26 October 2026 to address a range of critical and high‑severity vulnerabilities across its open‑source marketing automation platform. The standout issue is CVE-2026-115188, a critical remote code execution vulnerability tied to unrestricted file uploads in the campaign import feature, which could allow an authenticated user with import permissions to place server‑side scripts in a public media directory.

In addition, CVE-2026-115189, a server‑side template injection flaw in the Twig rendering sandbox, and CVE-2026-115190, insecure PHP object deserialization when reading segment filters and custom field properties, are addressed. These flaws are part of a broader set of fixes affecting various components of Mautic versions across multiple release lines.

The advisory lists a total of nine CVEs, with CVSS scores ranging up to 9.9 for the most severe issue. Notably, CVE-2026-115191 and CVE-2026-115192 describe high‑severity blind SQL injections that could enable extraction of password hashes and contact records, while CVE-2026-115193 concerns a stored XSS in Mautic 7.

Additional medium‑severity issues include CVE-2026-115194 (path traversal in the Asset API), CVE-2026-115195 (inadequate access control on the /api/stats/{table} endpoint), and CVE-2026-115196 (an unauthenticated open redirect in /form/submit). The affected versions span Mautic 7.x prior to 7.2.2, older 5.x and 6.x branches, and earlier 1.x to 5.x lines; the patches are released in 7.2.2, 6.0.10, and 5.2.12 respectively. The article notes that no public PoC exploits or in‑the‑wild activity had been confirmed at the time of reporting.