Cyber Resilience

CVE-2024-47051

RCE in Acquia Mautic ≤ 5.2.3

Published
26 February 2025
Modified
16 October 2025
Patch / advisory
CVSS Score v3.1 9.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS Score 0.018 76th percentile
Risk Priority 66 floored blend · peak EPSS

Summary

CVE-2024-47051 is a critical-severity Relative Path Traversal (CWE-23) vulnerability in Acquia Mautic. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 24% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2024-47051 covers two critical vulnerabilities in Mautic versions before 5.2.3. The first is a Remote Code Execution (RCE) flaw in the asset upload functionality, stemming from insufficient enforcement of allowed file extensions (CWE-94), which permits attackers to bypass restrictions and upload executable files such as PHP scripts. The second is a Path Traversal vulnerability (CWE-23) in the upload validation process, caused by improper handling of path components, enabling manipulation of the file deletion process.

These issues require low-privilege authenticated access (PR:L) and can be exploited remotely (AV:N) with low complexity (AC:L), no user interaction (UI:N), and scope change (S:C), earning a CVSS v3.1 score of 9.1 (C:H/I:L/A:L). Authenticated attackers could achieve RCE by uploading and executing malicious scripts, potentially compromising confidentiality, or delete arbitrary files via path traversal, disrupting integrity and availability on the host system.

The primary advisory at https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2 details these vulnerabilities, with mitigation achieved by upgrading to Mautic 5.2.3 or later, which enforces proper file extension checks and path handling in upload and deletion processes. Additional context on attack vectors is available in OWASP resources on Code Injection and Path Traversal.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. * Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset…

more

upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts. * Path Traversal File Deletion: A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
T1059.001 PowerShell Execution
Adversaries may abuse PowerShell commands and scripts for execution.
T1059.002 AppleScript Execution
Adversaries may abuse AppleScript for execution.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
T1059.005 Visual Basic Execution
Adversaries may abuse Visual Basic (VB) for execution.
T1059.006 Python Execution
Adversaries may abuse Python commands and scripts for execution.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-34990Shared CWE-23, CWE-94
CVE-2026-33435Shared CWE-23, CWE-94
CVE-2026-1340Shared CWE-94
CVE-2024-54724Shared CWE-94
CVE-2013-3906Shared CWE-94
CVE-2023-25261Shared CWE-94
CVE-2026-16144Shared CWE-94
CVE-2026-41196Shared CWE-94
CVE-2026-33336Shared CWE-94
CVE-2025-62521Shared CWE-94

Affected Assets

acquia
mautic
≤ 5.2.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V5.3.2
  • V1.3.1

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation finds code paths that accept and execute externally influenced strings.

Explicit validation of path inputs stops .. sequences from ever being interpreted by the file system.

Access enforcement directly blocks unauthorized file reads/writes that result from unresolved .. sequences.

Information-flow rules can be configured to reject traversals that would move data outside an approved directory boundary.

Least privilege reduces the set of reachable files even when a traversal succeeds.

Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and path sanitization that prevent relative traversal.

PR.DS-10 none match
prevents

PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development catches path traversal via static/dynamic analysis, but does not itself implement the fix.

prevents

Secure development lifecycle mandates input validation and path-handling controls that directly prevent relative path traversal.

prevents

Application security requirements explicitly call for controls against path traversal and other injection flaws.

prevents

Secure architecture principles include directory isolation and canonicalization, reducing but not eliminating traversal risk.

prevents

Secure coding standards require neutralizing path traversal sequences, directly addressing CWE-23.

mitigates

Information access restriction limits which files can be reached, mitigating impact but not preventing the traversal flaw.

References