A path traversal issue exists in the Mautic Asset API. An authenticated API user with permissions to create assets can specify a file path that is not restricted to the asset upload directory. This allows the registration of any file readable by the web server process as a Mautic asset. Once published, the public download URL serves the file contents without authentication, enabling the retrieval of arbitrary server files, such as system files and configuration files containing secret keys, database passwords, and SMTP credentials.