High severityGHSA Advisory· Published Dec 2, 2025· Updated Apr 15, 2026

CVE-2025-13827

Description

Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf the media folder is not restricted from running files this can lead to a remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
mautic/grapes-js-builder-bundlePackagist	>= 4.0.0, < 4.4.18	4.4.18
mautic/grapes-js-builder-bundlePackagist	>= 5.0.0, < 5.2.9	5.2.9
mautic/grapes-js-builder-bundlePackagist	>= 6.0.0, < 6.0.7	6.0.7

Affected products

Mautic/MauticGHSA
Range: >= 6.0.0, < 6.0.7
ghsa-coords
pkg:composer/mautic/grapes-js-builder-bundle
Range: >= 4.0.0, < 4.4.18

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-5xw2-57jx-pgjpghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-13827ghsaADVISORY
github.com/mautic/mautic/security/advisories/GHSA-5xw2-57jx-pgjpnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000