CVE-2021-27916: acquia mautic

csirt@kutim:~/threat-intel/cve/CVE-2021-27916

CVSS 8.1 · High EPSS 0,80%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada acquia mautic. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files. This vulnerability exists in the implementation of the GrapesJS builder in Mautic.

Rincian

Terbit di NVD: 17 September 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 0,80% peluang dieksploitasi; lebih tinggi dari 55,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
acquia	mautic	Versi 3.3.0 hingga sebelum 4.4.12
acquia	mautic	Versi 5.0.0 hingga sebelum 5.0.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/mautic/mautic/security/advisories/GHSA-9fcx-cv56-w58p advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.