Code execution and file deletion via upload validation

Code injection and path traversal in Mautic before 5.2.3 allow remote authenticated users to execute PHP and delete arbitrary files. AssetBundle upload validation accepts attacker-controlled temporary and original filenames without consistently enforcing allowed extensions or MIME types, while path components can reach the file-deletion operation. Access to the asset upload workflow is required; successful exploitation runs uploaded PHP in the web server context or removes host files.