An unrestricted file upload issue exists in the campaign import feature. When processing a campaign archive, the application copies bundled asset files into a publicly accessible media directory without restricting file names or types. An authenticated user with permissions to create campaign imports can exploit this via the user interface or the '/api/campaigns/import' endpoint to place arbitrary files, such as server-side scripts, in the web root. This does not require administrator privileges. On web servers that honor per-directory configuration, such as the default Apache setup in the official Mautic Docker image, this can lead to remote code execution with the privileges of the web server user, granting access to application secrets, configuration, and contact data.