medium4.3
CVE-2022-25773
Mautic allows Relative Path Traversal in assets file upload
Impact
### Summary This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. * **Improper Limitation of a Pathname to a Restricted Directory:** A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory. ### Mitigation Please update to 5.2.3 or later. ### Workarounds None ### References If you have any questions or comments about this advisory: Email us at [security@mautic.org](mailto:security@mautic.org)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | mautic/core | < 5.2.3 | 5.2.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Acquia | Mautic | before 5.2.3 |