Mautic 7.2.2 Patches Critical Remote Code Execution and SQL Injection Vulnerabilities
Do Son 
TL;DR
The Mautic project released security updates on October 26, 2026, to resolve multiple critical and high-severity Mautic vulnerabilities across its open-source marketing automation platform. The most severe flaw, CVE-2026-115188, carries a critical 9.9 CVSS score and enables remote code execution through unrestricted file uploads. Therefore, system administrators must upgrade their installations to versions 7.2.2, 6.0.10, or 5.2.12 immediately.
- Total: 9 CVEs
- Severity: 1 Critical · 5 High · 3 Medium
- Actively exploited: None confirmed
- Highest severity: 9.9 (Critical · CVSSv3) — CVE-2026-115188
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-115188 | 9.9 | CWE-94 | 7.2.2 | Not exploited |
| CVE-2026-115189 | 8.8 | CWE-1336 | 5.2.12, 6.0.10, 7.2.2 | Not exploited |
| CVE-2026-115193 | 8.2 | CWE-79 | 7.2.2 | Not exploited |
| CVE-2026-115190 | 8 | CWE-502 | 5.2.12, 6.0.10, 7.2.0 | Not exploited |
| CVE-2026-115191 | 7.1 | CWE-89 | 5.2.12, 6.0.10, 7.2.2 | Not exploited |
| CVE-2026-115192 | 7.1 | CWE-89 | 5.2.12, 6.0.10, 7.2.2 | Not exploited |
| CVE-2026-115194 | 6.5 | CWE-22 | 5.2.12, 6.0.10, 7.2.2 | Not exploited |
| CVE-2026-115195 | 6.5 | CWE-862 | 5.2.12, 6.0.10, 7.2.2 | Not exploited |
Why It Matters
Mautic is a widely deployed open-source marketing automation platform used by over 200,000 organizations worldwide to manage customer campaigns and contact data. Because marketing servers store sensitive personal data, visitor geolocation records, and SMTP credentials, they are attractive targets for threat actors.
Leaving these Mautic vulnerabilities unpatched exposes self-hosted environments to full server takeover, database extraction, and unauthorized file access. Currently, no public proof-of-concept exploit code exists. In addition, no active exploitation in the wild has been confirmed for any of the disclosed flaws.
How the Attack Works
The October 2026 security advisories cover distinct flaws in campaign imports, Twig template rendering, database deserialization, SQL query construction, and API access controls.
Critical RCE, Sandbox Escape, and PHP Object Injection
First, CVE-2026-115188 (CVSS 9.9) is a critical unrestricted file upload vulnerability in the Mautic 7 campaign import feature. When processing an uploaded campaign archive via the user interface or /api/campaigns/import, the application copies bundled assets into a public media directory without checking file names or types. On web servers that honor per-directory configurations, such as the default Apache setup in the official Mautic Docker image, an authenticated user with import permissions can upload server-side scripts to achieve remote code execution.
Next, CVE-2026-115189 (CVSS 8.8) is a server-side template injection flaw in the Twig theme rendering sandbox. Serving as a complete fix for the earlier incomplete patch GHSA-9fx4-7cmj-47vg, this update stops authenticated users with the core:themes:create permission from uploading crafted themes that escape the sandbox and run operating system commands. Meanwhile, CVE-2026-115190 (CVSS 8.0) involves insecure deserialization (PHP object injection). This occurs when reading segment filters and custom field properties from the database without Mautic’s safe deserialization helper.
SQL Injection and Stored Cross-Site Scripting
Furthermore, two high-severity blind SQL injection bugs (CVSS 7.1) allow authenticated users to extract password hashes and contact records. In CVE-2026-115191, the /s/ajax contact lookup endpoint fails to validate the search field parameter during lead:getLeadIdsByFieldValue actions. Similarly, CVE-2026-115192 allows API users to inject SQL via chart filter parameters in the /api/data/{type} dashboard widget endpoint. In addition, CVE-2026-115193 (CVSS 8.2) is a stored cross-site scripting (XSS) flaw in Mautic 7. Here, HTML-type custom contact fields render without output sanitization on the contact detail page.
API Path Traversal, Access Control, and Open Redirect
Finally, three medium-severity Mautic vulnerabilities impact API and form endpoints. CVE-2026-115194 (CVSS 6.5) is a path traversal bug in the Asset API. It lets authenticated users register local server files, such as configuration files containing database and SMTP passwords, as public downloadable assets. In CVE-2026-115195 (CVSS 6.5), broken access control in the /api/stats/{table} endpoint exposes internal audit logs and visitor IP addresses to zero-permission API accounts. Lastly, CVE-2026-115196 (CVSS 5.4) is an unauthenticated open redirect in the /form/submit endpoint. It sends visitors to untrusted external URLs after submitting a crafted form.
Affected Versions
CVE-2026-115188 and CVE-2026-115193 exclusively affect Mautic 7 versions from 7.0.0 before 7.2.2. Meanwhile, CVE-2026-115190 impacts versions 2.15.2 before 5.2.12, 6.0.0 before 6.0.10, and 7.0.0 before 7.2.0. The remaining flaws affect various older release branches starting from 1.0.0-beta through versions prior to 5.2.12, 6.0.10, and 7.2.2.
Patch and Mitigation Steps
Administrators should upgrade immediately to the latest patched releases, including Mautic 7.2.2, 6.0.10, or 5.2.12. CVE-2026-115190 was resolved starting in 7.2.0 for the 7.x line. If an immediate upgrade is impossible, defenders should restrict campaign import, theme creation, and API permissions to trusted administrators. Also, they should block script execution inside the media/ directory at the web server level, and filter /s/ajax requests via a web application firewall.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
