{"id":"CVE-2025-13827","state":"PUBLISHED","title":"GrapesJsBuilder File Upload allows all file uploads","description":"Summary\nArbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. \nImpactIf the media folder is not restricted from running files this can lead to a remote code execution.","publishedAt":"2025-12-02T16:54:39.986Z","updatedAt":"2025-12-02T17:10:25.179Z","severity":{"score":8.8,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","source":"Mautic"},"assigner":"Mautic","products":["Mautic Mautic"],"affected":[{"vendor":"Mautic","product":"Mautic","packageName":"core","defaultStatus":"unaffected","versions":[{"version":"<4.4.18, <5.2.9, <6.0.7","status":"affected","versionType":"semver"}],"collectionURL":"https://packagist.org","repo":"https://github.com/mautic/mautic"}],"references":["https://github.com/mautic/mautic/security/advisories/GHSA-5xw2-57jx-pgjp"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/13xxx/CVE-2025-13827.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-13827","state":"PUBLISHED","datePublished":"2025-12-02T16:54:39.986Z","dateUpdated":"2025-12-02T17:10:25.179Z","assignerShortName":"Mautic","assignerOrgId":"4e531c38-7a33-45d3-98dd-d909c0d8852e","dateReserved":"2025-12-01T15:20:24.945Z"},"containers":{"cna":{"title":"GrapesJsBuilder File Upload allows all file uploads","descriptions":[{"lang":"en","value":"Summary\nArbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. \nImpactIf the media folder is not restricted from running files this can lead to a remote code execution."}],"affected":[{"vendor":"Mautic","product":"Mautic","packageName":"core","defaultStatus":"unaffected","versions":[{"version":"<4.4.18, <5.2.9, <6.0.7","status":"affected","versionType":"semver"}],"collectionURL":"https://packagist.org","repo":"https://github.com/mautic/mautic"}],"references":[{"url":"https://github.com/mautic/mautic/security/advisories/GHSA-5xw2-57jx-pgjp"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":8.8,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Mautic","orgId":"4e531c38-7a33-45d3-98dd-d909c0d8852e","dateUpdated":"2025-12-02T16:54:39.986Z"},"credits":[{"lang":"en","type":"reporter","value":"Jason Woods (driskell)"},{"lang":"en","type":"remediation reviewer","value":"Patryk Gruszka (patrykgruszka)"},{"lang":"en","type":"remediation reviewer","value":"Jan Linhart (escopecz)"},{"lang":"en","type":"remediation developer","value":"Jason Woods (driskell)"}],"datePublic":"2025-12-01T15:10:00.000Z","impacts":[{"capecId":"CAPEC-244","descriptions":[{"lang":"en","value":"CAPEC-244 XSS Targeting URI Placeholders"}]}],"source":{"advisory":"GHSA-5xw2-57jx-pgjp","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-02T17:10:05.493140Z","id":"CVE-2025-13827","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-02T17:10:25.179Z"}}]}}}