CVE-2021-27916

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files.

This vulnerability exists in the implementation of the GrapesJS builder in Mautic.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Sep 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-279175.4Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.CVE-2021-279187.5encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF CVE-2021-279195.5archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a CVE-2021-279217.5Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not CVE-2021-279227.5Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not CVE-2021-279237.5Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not CVE-2021-279245.9An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session cookies in the logs. Th CVE-2021-279254.4An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condi CVE-2021-279278.8In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControll CVE-2021-279287.2A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.CVE-2021-279305.4Multiple stored XSS vulnerabilities in IrisNext Edition 9.5.16, which allows an authenticated (or compromised) user to inject malicious Java CVE-2021-279319.1LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can