GHSA-4w2w-36vm-c8hf
Mautic allows Relative Path Traversal in assets file upload
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | mautic/core | < 5.2.3 | 5.2.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.
* **Improper Limitation of a Pathname to a Restricted Directory:** A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.
### Mitigation
Please update to 5.2.3 or later.
### Workarounds
None
### References
If you have any questions or comments about this advisory:
Email us at [[email protected]](mailto:[email protected])
References
External links from the advisory. They lead to third-party sites.