CVE-2025-13827
BaseFortify
Publication date: 2025-12-02
Last updated on: 2025-12-02
Assigner: Mautic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mautic | grapes_js_builder | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
If the media folder is not restricted from running files, this vulnerability can lead to remote code execution, potentially allowing an attacker to execute malicious code on the affected system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, restrict the media folder from executing files to prevent remote code execution. Additionally, implement file upload restrictions to limit the types of files that can be uploaded via the GrapesJS Builder.
Can you explain this vulnerability to me?
This vulnerability allows arbitrary files to be uploaded via the GrapesJS Builder because there are no restrictions on the types of files that can be uploaded.