CVE-2021-27916

HIGH

Mautic 3.3.0-4.4.11 - Authenticated Path Traversal and Arbitrary File Deletion via GrapesJS Builder

Title source: llm
STIX 2.1

Description

Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files. This vulnerability exists in the implementation of the GrapesJS builder in Mautic.

References (1)

Core 1

Scores

CVSS v3 8.1
EPSS 0.0080
EPSS Percentile 52.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
acquia/mautic 3.3.0 - 4.4.12
mautic/core 3.3.0 - 4.4.12Packagist
Published Sep 17, 2024
Tracked Since Feb 18, 2026