CVE-2022-25773: Mautic allows Relative Path Traversal in assets file upload

February 26, 2025 (updated October 16, 2025)

This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.

Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.

References

github.com/advisories/GHSA-4w2w-36vm-c8hf
github.com/mautic/mautic
github.com/mautic/mautic/commit/e6aaad99f399c5df1ce6273609920098e5c2564a
github.com/mautic/mautic/security/advisories/GHSA-4w2w-36vm-c8hf
nvd.nist.gov/vuln/detail/CVE-2022-25773

Code Behaviors & Features

Detect and mitigate CVE-2022-25773 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →