GHSA-5xw2-57jx-pgjp

ghsaUSosv

GrapesJsBuilder File Upload allows all file uploads

view advisory published 2025-12-02Licence: CC-BY-4.0

### Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ### Impact If the media folder is not restricted from running files this can lead to a remote code execution.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-13827US	—	0.42% (36th)	—	2025-12-02
Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf the media folder is not restricted from r…

references

External citations — patches, advisories, analysis.

https://github.com/mautic/mauticPACKAGE
https://github.com/mautic/mautic/security/advisories/GHSA-5xw2-57jx-pgjpWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-13827ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan