Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:LSummary
CVE-2024-47051 is a critical-severity Relative Path Traversal (CWE-23) vulnerability in Acquia Mautic. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 24% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-47051 covers two critical vulnerabilities in Mautic versions before 5.2.3. The first is a Remote Code Execution (RCE) flaw in the asset upload functionality, stemming from insufficient enforcement of allowed file extensions (CWE-94), which permits attackers to bypass restrictions and upload executable files such as PHP scripts. The second is a Path Traversal vulnerability (CWE-23) in the upload validation process, caused by improper handling of path components, enabling manipulation of the file deletion process.
These issues require low-privilege authenticated access (PR:L) and can be exploited remotely (AV:N) with low complexity (AC:L), no user interaction (UI:N), and scope change (S:C), earning a CVSS v3.1 score of 9.1 (C:H/I:L/A:L). Authenticated attackers could achieve RCE by uploading and executing malicious scripts, potentially compromising confidentiality, or delete arbitrary files via path traversal, disrupting integrity and availability on the host system.
The primary advisory at https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2 details these vulnerabilities, with mitigation achieved by upgrading to Mautic 5.2.3 or later, which enforces proper file extension checks and path handling in upload and deletion processes. Additional context on attack vectors is available in OWASP resources on Code Injection and Path Traversal.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2855
Vulnerability Data
This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. * Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset…
more
upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts. * Path Traversal File Deletion: A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2V1.3.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation finds code paths that accept and execute externally influenced strings.
Explicit validation of path inputs stops .. sequences from ever being interpreted by the file system.
Access enforcement directly blocks unauthorized file reads/writes that result from unresolved .. sequences.
Information-flow rules can be configured to reject traversals that would move data outside an approved directory boundary.
Least privilege reduces the set of reachable files even when a traversal succeeds.
Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that prevent relative traversal.
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis, but does not itself implement the fix.
Secure development lifecycle mandates input validation and path-handling controls that directly prevent relative path traversal.
Application security requirements explicitly call for controls against path traversal and other injection flaws.
Secure architecture principles include directory isolation and canonicalization, reducing but not eliminating traversal risk.
Secure coding standards require neutralizing path traversal sequences, directly addressing CWE-23.
Information access restriction limits which files can be reached, mitigating impact but not preventing the traversal flaw.