Arbitrary File Upload Vulnerability in Mautic's GrapesJS Builder

CVE-2025-13827

What is CVE-2025-13827?

Mautic's GrapesJS Builder contains a vulnerability that allows an attacker to upload arbitrary files, as there are no restrictions on the types of files that can be processed. If the media folder is not restricted from executing uploaded files, this flaw can be exploited to achieve remote code execution, potentially compromising the affected system. It is crucial for users and administrators to ensure appropriate measures are taken to secure the media directory and mitigate risks associated with this vulnerability.

References