What is GHSA-5xw2-57jx-pgjp?

GHSA-5xw2-57jx-pgjp is a security advisory published by GitHub Security Advisories with High severity. GrapesJsBuilder File Upload allows all file uploads

Which CVE IDs does GHSA-5xw2-57jx-pgjp cover?

GHSA-5xw2-57jx-pgjp covers the following CVE IDs: CVE-2025-13827. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-5xw2-57jx-pgjp?

GHSA-5xw2-57jx-pgjp affects 3 products, including: composer/mautic/grapes-js-builder-bundle:\u003e= 4.0.0, \u003c 4.4.18; composer/mautic/grapes-js-builder-bundle:\u003e= 5.0.0, \u003c 5.2.9; composer/mautic/grapes-js-builder-bundle:\u003e= 6.0.0, \u003c 6.0.7.

GHSA-5xw2-57jx-pgjpHigh

GrapesJsBuilder File Upload allows all file uploads

Vendor

GitHub Security Advisories

Published

December 2, 2025

Last Modified

December 2, 2025

🔗 CVE IDs covered (1)

CVE-2025-13827 →

📋 Description

Summary

Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted.

Impact

If the media folder is not restricted from running files this can lead to a remote code execution.

🎯 Affected products3

composer/mautic/grapes-js-builder-bundle:>= 4.0.0, < 4.4.18
composer/mautic/grapes-js-builder-bundle:>= 5.0.0, < 5.2.9
composer/mautic/grapes-js-builder-bundle:>= 6.0.0, < 6.0.7

🔗 References (3)

https://github.com/mautic/mautic/security/advisories/GHSA-5xw2-57jx-pgjp
https://nvd.nist.gov/vuln/detail/CVE-2025-13827
https://github.com/advisories/GHSA-5xw2-57jx-pgjp