CVE-2026-115194

Name of the Vulnerable Software and Affected Versions Mautic (affected versions not specified)

Description A path traversal issue exists in the Mautic Asset API. An authenticated API user with permissions to create assets can specify a file path that is not restricted to the asset upload directory. This allows the registration of any file readable by the web server process as a Mautic asset. Once published, the public download URL serves the file contents without authentication, enabling the retrieval of arbitrary server files, such as system files and configuration files containing secret keys, database passwords, and SMTP credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.