high8.8
CVE-2025-13827
GrapesJsBuilder File Upload allows all file uploads
Impact
### Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ### Impact If the media folder is not restricted from running files this can lead to a remote code execution.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | mautic/grapes-js-builder-bundle | >= 4.0.0, < 4.4.18 | 4.4.18 |