Moath Aloufi

An unrestricted file upload issue exists in the campaign import feature. When processing a campaign archive, the application copies bundled asset files into a publicly accessible media directory without restricting file names or types. An authenticated user with permissions to create campaign imports can exploit this via the user interface or the '/api/campaigns/import' endpoint to place arbitrary files, such as server-side scripts, in the web root. This does not require administrator privileges. On web servers that honor per-directory configuration, such as the default Apache setup in the official Mautic Docker image, this can lead to remote code execution with the privileges of the web server user, granting access to application secrets, configuration, and contact data.

A server-side template injection occurs in the Twig theme rendering sandbox. The sandbox, designed to restrict user-uploaded theme templates, fails to fully enforce restrictions, allowing a crafted template to escape. An authenticated user with the `core:themes:create` permission can upload a malicious theme that, when rendered, enables arbitrary code execution with the privileges of the web server process. This allows for the execution of operating system commands, reading of server-side files such as configuration files and database credentials, writing files, and accessing internal services.

A stored Cross-Site Scripting (XSS) issue exists in the contact detail view. HTML-type custom contact fields are rendered without output sanitization, allowing a user or integration to store a script payload via contact editing, the contact API, or form submissions mapped to the field. When an administrator or another user views the affected contact's detail page, the script executes in their browser session. This can lead to unauthorized administrative actions, including the creation of new administrator accounts, modification of system configurations, or unauthorized access to campaign and contact data.