The Mautic project released security updates on October 26 that fix a critical remote code execution flaw, CVE-2026-115188, rated CVSS 9.9. Fixed versions are 7.2.2, 6.0.10 and 5.2.12.
The account relies on a single outlet’s report. The remaining CVE numbers should be checked against the Mautic advisories.
CVE-2026-115188 Unrestricted File Upload in Mautic 7 Campaign Import
The most severe flaw is an unrestricted file upload in the campaign import function of Mautic 7. The import is reachable through the user interface and through the /api/campaigns/import endpoint, and the upload leads to remote code execution on the server.
Twig, Deserialization and SQL Injection Flaws Fixed in Mautic
The advisories cover additional flaws in campaign imports, Twig template rendering, database deserialization, SQL query construction and API access controls. The report highlights remote code execution and SQL injection as the main categories.
What Is at Stake on a Compromised Mautic Server
Mautic is open-source marketing automation software, described as used by more than 200,000 organizations. A Mautic server holds personal data, geolocation records and SMTP credentials. Self-hosted instances therefore risk full server takeover and extraction of the database.
No Public Exploit or Confirmed Attacks on Mautic Yet
The report says there is no public proof-of-concept and no confirmed exploitation in the wild. The 200,000 figure is the report’s description of Mautic’s user base and was not independently verified.
Three Maintained Release Lines Receive Fixes
The project shipped patches across three release lines: 7.2.2, 6.0.10 and 5.2.12. Users on any of those lines are directed to upgrade to the corresponding fixed version.
Why SMTP Credentials and Geolocation Records Raise the Stakes
SMTP credentials stored on the server could be used to send mail through an organization’s own mail infrastructure, and geolocation records and personal data add to the exposure of contacts held in the marketing database. The report lists these categories as what a compromised server holds; it does not describe any case in which they were taken.
The campaign import path is a feature administrators use routinely, and the report names both the UI and the API endpoint as ways to reach the vulnerable code. The report does not say how many instances expose the API or the import interface to untrusted users.
Mautic’s maintainers published the fixes together with advisories for the full set of flaws, and the release lines named in the advisories are the only versions confirmed to contain the repairs.
Mautic 7.2.2, 6.0.10 and 5.2.12 Release Details and Reporting Limits
Mautic’s October 26 release covers three version lines at once. Version 7.2.2 serves the current Mautic 7 line, where the campaign import flaw was identified. Versions 6.0.10 and 5.2.12 cover the older lines. The report lists the flaws by area, namely campaign imports, Twig template rendering, database deserialization, SQL query construction and API access controls, but gives only one CVE number, CVE-2026-115188.
The weaknesses span both code execution and data access. The report names SQL injection alongside the remote code execution flaw, and lists the API access control issues as a separate category.
The impact described for self-hosted instances is full server takeover and database extraction. Because a Mautic server holds personal data, geolocation records and SMTP credentials, a compromise of the server reaches the data of the organization’s contacts as well as its mail-sending configuration.
The report states that no public proof of concept exists and no exploitation in the wild has been confirmed. Its description of Mautic as used by more than 200,000 organizations has not been verified independently, and the identifiers for the remaining vulnerabilities should be confirmed against the Mautic advisories before they are cited.
