CVE-2021-27916CWE-22

Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder)

High · published September 17, 2024

CVSS v3.1
8.1
EPSS
1%
Percentile
56.1
In the wild
Unconfirmed
What it is

Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files.

This vulnerability exists in the implementation of the GrapesJS builder in Mautic.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00800 · 56.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-09-17T14:20Z
EPSS history
Timeline
  • 17 SEP 14:20Z
    Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder)
    cvelistv5