Remote Code Execution and File Deletion Vulnerabilities in Mautic by Mautic

CVE-2024-47051

Summary

This advisory highlights two significant security vulnerabilities in Mautic that could be exploited by authenticated users. The first involves a Remote Code Execution (RCE) vulnerability associated with the asset upload feature, where weak enforcement of allowed file types enables attackers to upload malicious files, like PHP scripts. Secondly, a Path Traversal vulnerability has been detected during the upload validation process, allowing attackers to manipulate file paths and delete arbitrary files from the host system, posing a serious risk to data integrity and security.

References