CVE-2021-27916
Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder)
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder)
Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files. This vulnerability exists in the implementation of the GrapesJS builder in Mautic.
Reserved 2021-03-02 | Published 2024-09-17 | Updated 2024-09-18 | Assigner MauticCWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Mattias Michaux
Lenon Leite
Adrian Schimpf
Avikarsha Saha
John Linhart
github.com/...mautic/security/advisories/GHSA-9fcx-cv56-w58p
Support options
