What is the CVSS score of CVE-2025-13827?

CVE-2025-13827 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2025-13827?

Within 24 hours: Disable GrapesJS Builder functionality or restrict access to trusted users only; audit recent file uploads in media folders for suspicious content. Within 7 days: Implement file upload restrictions and configure web server to prevent code execution in media directories; review access logs for exploitation attempts. Within 30 days: Evaluate alternative solutions or establish a formal remediation timeline; conduct penetration testing to verify exploit prevention.

CVE-2025-13827

EUVD-2025-200276 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-12-02 security@mautic.org

GHSA-5xw2-57jx-pgjp

RCE File Upload

8.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 14:04 euvd

EUVD-2025-200276

Analysis Generated

Mar 15, 2026 - 14:04 vuln.today

CVE Published

Dec 02, 2025 - 17:16 nvd

HIGH 8.8

DescriptionCVE.org

Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf the media folder is not restricted from running files this can lead to a remote code execution.

Analysis

Technical ContextAI

Unrestricted file upload allows attackers to upload malicious files (web shells, executables) that can then be executed on the server. This vulnerability is classified as Unrestricted Upload of File with Dangerous Type (CWE-434).