GHSA-5xw2-57jx-pgjp
GrapesJsBuilder File Upload allows all file uploads
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | mautic/grapes-js-builder-bundle | >= 4.0.0, < 4.4.18 | 4.4.18 |
| Packagist | mautic/grapes-js-builder-bundle | >= 5.0.0, < 5.2.9 | 5.2.9 |
| Packagist | mautic/grapes-js-builder-bundle | >= 6.0.0, < 6.0.7 | 6.0.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted.
### Impact
If the media folder is not restricted from running files this can lead to a remote code execution.
References
External links from the advisory. They lead to third-party sites.