Skip to content
OpenAdvisories
Medium · 4.3 CVE-2022-25773 EUVD-2022-30417GHSA-4w2w-36vm-c8hf

Relative Path Traversal in assets file upload

Published Feb 26, 2025 · Updated Mar 12, 2025 · Assigned by Mautic

Description

This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.

* Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.

Affected products

VendorProductAffectedFixed
Mautic mautic/core < 5.2.3 —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist mautic/core < 5.2.3 5.2.3 GHSA-4w2w-36vm-c8hf

References