CVE-2024-47051 is a critical severity (CVSS 9.1) pair of flaws in Mautic before 5.2.3. Authenticated users could upload executable files through asset uploads, and abuse path handling to delete arbitrary files. The Mautic advisory says to update to 5.2.3 or later, and lists no workarounds.
What's affected
The GitHub advisory GHSA-73gx-x7r9-77x2 covers the Composer package mautic/core and names affected versions as anything below 5.2.3. The patched version is 5.2.3.
The advisory says there are no workarounds. That makes the upgrade the only response, apart from limiting who has accounts.
Both issues need an authenticated user. They are not open to anonymous visitors, so your exposure depends on how many people hold accounts and how well those accounts are protected.
How to check if you're exposed
Read your Mautic version from the admin dashboard footer or from Composer.
composer show mautic/core
Any version below 5.2.3 is affected. Also review who can log in: list the user accounts, their roles, and whether any belong to former staff or agencies. Check the web server upload directory for files that are not images or documents, such as scripts, because the advisory describes uploads of executable files as the risk.
What to do now
- Take a backup of the database and the application files.
- Update mautic/core to 5.2.3 or later and run the post update steps from the Mautic upgrade guide.
- Audit user accounts and remove those that are no longer needed.
- Turn on multi factor authentication for remaining accounts where your setup allows it.
- Inspect the asset upload directory for unexpected executable files, and make sure the web server does not run scripts from that directory.
- Check your backups, since the second flaw allows arbitrary file deletion.
Why it matters
There are two weaknesses here. The first is code injection through an unrestricted upload: the asset upload did not enforce the allowed file extensions, so an attacker could bypass the restriction and upload a PHP script. That maps to CWE-94 (Code Injection). The second is CWE-23 (Relative Path Traversal), where improper handling of path components in the upload validation lets a user steer the delete operation to files outside the intended folder.
Upload features are a repeat source of serious bugs because the server ends up holding attacker supplied content. Allow lists on extension, content type, and storage path all have to agree. The record does not mark this as exploited, and it is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-47051.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need an account on Mautic to be hit by this?
The advisory says the flaws could be exploited by authenticated users, so an attacker needs a login.
Is there a workaround?
No. The advisory lists none, so update to 5.2.3 or later.
Sources
Last reviewed: 19 October 2026.
