---
id: "CVE-2026-115194"
kind: "vulnerability"
aliases: ["CVE-2026-115194"]
title: "Mautic: asset API lets an authenticated user expose any server file"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mautic", "package", "php", "self-hosted"]
not_affected_if: ["asset-create-restricted-to-trusted-users"]
published_at: "2026-10-26T14:16:30+00:00"
first_seen_at: "2026-10-26T14:30:36+00:00"
updated_at: "2026-10-26T14:32:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115194", "first_seen_at": "2026-10-26T14:30:36+00:00"}]
---

# Mautic: asset API lets an authenticated user expose any server file

An authenticated user who can create assets in Mautic can register any file the web server can read as a local asset via the API. Once published, anyone with the public URL can download that file, including configuration files with database, secret key and SMTP credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Mautic version with `composer show mautic/core-lib` or the version shown in the admin panel
- Review which users or API roles hold permission to create assets
- unknown

## Fix

- Upgrade Mautic to a release that restricts local asset paths to the upload directory (the fixed version is unknown from the sources)
- Rotate the database password, secret key and SMTP credentials if an untrusted user had asset-create permission
- Unpublish any assets whose source path is outside the upload directory

## Timeline

- 2026-10-26T14:30:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115194

## From the sources

A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API user with permission to create assets can register any file that is readable by the web server process as a Mautic asset. When the asset is published, its public download URL serves the contents of that file without authentication. This allows the attacker to read arbitrary files from the server, including Mautic configuration files containing the database password, secret key, and mail (SMTP) credentials, as well as system files and any other file readable by the web server user. Exposed credentials can be used to access the database or other connected services, and anyone with the public asset URL can retrieve the file contents.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_