This vulnerability arises from improper validation of file paths during ZIP extraction in Mautic 7's campaign import functionality. An attacker with authenticated campaign import rights can craft ZIP archives containing file paths that traverse directories outside the intended extraction folder. This path traversal allows overwriting or creating PHP files in sensitive system directories, leading to remote code execution under the web server user context. The issue is classified under CWE-22 (Path Traversal), CWE-73, and CWE-98, reflecting weaknesses in pathname limitation and improper control of file operations. The CVSS 3.1 score of 9.9 reflects its critical severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

An attacker with authenticated campaign import privileges can achieve remote code execution on the affected Mautic 7 system. This can compromise the confidentiality, integrity, and availability of the system by allowing arbitrary PHP code execution, potentially leading to full system compromise or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict campaign import privileges to trusted users only and monitor for suspicious activity related to file uploads. Avoid exposing the campaign import functionality to untrusted users. Follow vendor communications closely for updates on patches or official mitigations.