TI-2024-31435 Aliases CVE-2024-47051 GHSA-73gx-x7r9-77x2

Remote Code Execution & File Deletion in Asset Uploads

MEDIUM 46CWE-23Published 2025-02-26 · Updated 2025-02-26

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. * Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts. * Path Traversal File Deletion: A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01799 78th percentileScored 2026-11-07

Fix Fixed mautic/core (Mautic): 5.2.3mautic/core (Packagist): 5.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Mautic	mautic/core	before 5.2.3	5.2.3	Patch available	CNA
—	mautic/core (Packagist)	before 5.2.3	5.2.3	Patch available	GHSA-73gx-x7r9-77x2

mautic/core VendorMautic Affected before 5.2.3 Fixed in 5.2.3 Patch available CNA
mautic/core (Packagist) Vendor— Affected before 5.2.3 Fixed in 5.2.3 Patch available GHSA-73gx-x7r9-77x2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:acquia:mautic::::::::	before 5.2.3	Vulnerable	Acquia

cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:* Versions before 5.2.3 Vulnerable ·Acquia

Remediation

Fix · CNA mautic/core (Mautic) Fixed in 5.2.3
Fix · GHSA-73gx-x7r9-77x2 mautic/core (Packagist) Fixed in 5.2.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-47051
2026-10-03 Alias added: GHSA-73gx-x7r9-77x2

References

Advisory 2

Other 4

TI-2022-09344 Cross-site scripting in Mautic CVSS 3.1CRITICAL 9.6
TI-2024-02543 Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.3
TI-2024-02544 Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.4
TI-2024-03218 Improper Access Control Leads to Server-Side Request Forgery in Mautic CVSS 3.1MEDIUM 5.0
TI-2018-05847 Mautic before 2.13.0 allows CSV injection. CVSS 3.0CRITICAL 9.8
TI-2022-09342 Improper regex in htaccess file CVSS 3.1CRITICAL 9.1

See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences