CVE-2024-47051 json
Remote Code Execution & File Deletion in Asset Uploads
published 2025-02-26 20 mo ago modified 2026-06-17 4 mo ago also GHSA-73gx-x7r9-77x2 , EUVD-2024-2855
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 78%
- public exploits
- 0
- none known
Summary
This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users.
* Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts.
* Path Traversal File Deletion: A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
1.80% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L |
| NVD | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | mautic/core | <5.2.3 |
5.2.3 |
Affected products
- Mautic mautic/core
Classification
References
-
github.com
/mautic/mautic/commit/75bc488ce98b9c8ec01114984049fc1c42c0cae5
web
-
github.com
/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2
web, vendor-advisory
-
owasp.org
/www-community/attacks/Code_Injection
web, not-applicable
-
owasp.org
/www-community/attacks/Path_Traversal
web, not-applicable
-
nvd.nist.gov
/vuln/detail/CVE-2024-47051
advisory
-
github.com
/mautic/mautic
package
Sources
- CVE List CVE-2024-47051
- GitHub Advisory GHSA-73gx-x7r9-77x2
- NVD CVE-2024-47051
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.