MEDIUM6.5

GHSA-qpgw-2c72-4c89

Mautic users able to download any files from server using filemanager

Quick fix

GHSA-qpgw-2c72-4c89 — mautic/core: upgrade to the fixed version with the command below.

composer require mautic/core:^2.12.0

Details

### Impact Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

### Patches Update to 2.12.0 or later.

### Workarounds None

### For more information If you have any questions or comments about this advisory: * Email us at [security@mautic.org](mailto:security@mautic.org)

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mautic/core

Introduced in: 1.0.0Fixed in: 2.12.0

Fixcomposer require mautic/core:^2.12.0

References

https://github.com/mautic/mautic/security/advisories/GHSA-qpgw-2c72-4c89[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2017-1000490[ADVISORY]
https://github.com/mautic/mautic/commit/3b01786433ae15e9a23f1eb9b0d3dfdb065b6241[WEB]
https://github.com/mautic/mautic/releases/tag/2.12.0[WEB]