Live › vulnerability › CVE-2026-115194
Go to dashboardAn authenticated user who can create assets in Mautic can register any file the web server can read as a local asset via the API. Once published, anyone with the public URL can download that file, including configuration files with database, secret key and SMTP credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Mautic installations where users or API clients hold permission to create assets through the API. Instances where asset creation is restricted to trusted staff carry less practical risk, but the flaw still lets any such user read server files. Teams not running Mautic can skip it.
No product ranges from the sources yet.
composer show mautic/core-lib or the version shown in the admin panelEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API user with permission to create assets can register any file that is readable by the web server process as a Mautic asset. When the asset is published, its public download URL serves the contents of that file without authentication. This allows the attacker to read arbitrary files from the server, including Mautic configuration files containing the database password, secret key, and mail (SMTP) credentials, as well as system files and any other file readable by the web server user. Exposed credentials can be used to access the database or other connected services, and anyone with the public asset URL can retrieve the file contents.
This page as .md · .json · in your agent: get_signal("CVE-2026-115194")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.