CVE-2026-9559: Mautic vulnerable to Path Traversal via Campaign Import

July 2, 2026

A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories.

References

github.com/advisories/GHSA-6r9h-4h75-7q4x
github.com/mautic/mautic/security/advisories/GHSA-6r9h-4h75-7q4x
nvd.nist.gov/vuln/detail/CVE-2026-9559

Code Behaviors & Features

Detect and mitigate CVE-2026-9559 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →