CVE-2022-25773 Relative Path Traversal in assets file upload

Medium 4.3 Published 26 Feb 2025 Updated 12 Mar 2025

Attackers can upload assets to unintended server directories via path traversal in Mautic, potentially modifying files outside the intended upload area.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-25773?

CVE-2022-25773 is a medium-severity path traversal vulnerability in mautic/core, published on 26 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.

* Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.

Weakness: CWE-22

Which versions are affected by CVE-2022-25773?

2 open source packages ship an affected version, including mautic/core. It affects 1 product.

Package	Affected	Fixed in
`mautic/core` Packagist	All versions	`5.2.3`
`mautic/core` Packagist	All versions	`5.2.3`

Products include Acquia Mautic.

How do I fix CVE-2022-25773?

Upgrade mautic/core to 5.2.3 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-25773 being exploited?

There is no known exploitation of CVE-2022-25773 in the wild and no public exploit code.

Sources

Also known as GHSA-4w2w-36vm-c8hf.