Louis Sanchez

A path traversal issue exists in the Mautic Asset API. An authenticated API user with permissions to create assets can specify a file path that is not restricted to the asset upload directory. This allows the registration of any file readable by the web server process as a Mautic asset. Once published, the public download URL serves the file contents without authentication, enabling the retrieval of arbitrary server files, such as system files and configuration files containing secret keys, database passwords, and SMTP credentials.

Authenticated team members can perform a server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended destination. By providing a caller-controlled `host` parameter to the ClickHouse proxy test endpoint, an attacker can direct the server to arbitrary internal destinations due to a lack of URL validation or allowlist enforcement. This allows the disclosure of internal service response bodies through reflected error responses, enabling unauthorized access to internal APIs, container services, and cloud provider metadata endpoints.

The `Users::getUser()` function within the JSON-RPC API does not implement sufficient authorization checks. This allows authenticated users to retrieve complete user credential records by providing arbitrary user IDs. The exposed data includes password hashes, TOTP (Time-based One-Time Password) secrets, and session tokens, which can be used for account enumeration, offline password cracking, bypassing two-factor authentication, and session hijacking.