CVE-2025-4981

Published Jun 20, 2025

Last updated 2 months ago

Mattermost

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-4981 affects certain versions of Mattermost. It's a path traversal vulnerability found in the archive extractor. The vulnerability allows authenticated users to write files to arbitrary locations on the filesystem by uploading archives containing path traversal sequences in filenames. This vulnerability can lead to remote code execution. The issue exists in instances where file uploads and document search by content are enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true), which are the default settings.

Description: Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
Source: responsibledisclosure@mattermost.com
NVD status: Analyzed
Products: mattermost_server

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.9
Impact score: 6
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

responsibledisclosure@mattermost.com: CWE-427

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9CEF0379-7E63-452C-8084-067092A25D92",
            "versionEndExcluding": "9.11.16",
            "versionStartIncluding": "9.11.0"
          },
          {
            "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "77EE1558-3E63-4178-90EB-DBC8F99B75AB",
            "versionEndExcluding": "10.5.6",
            "versionStartIncluding": "10.5.0"
          },
          {
            "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5E1A952E-F96B-4D50-B8FD-7CAFFE73263F",
            "versionEndExcluding": "10.6.6",
            "versionStartIncluding": "10.6.0"
          },
          {
            "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "28D55588-A52A-4ADD-AC90-A46BED4555A1",
            "versionEndExcluding": "10.7.3",
            "versionStartIncluding": "10.7.0"
          },
          {
            "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.8.0:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "20DB174F-F76D-49F1-BB44-638A5FA71CDA"
          },
          {
            "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.8.0:rc1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "51CA3B67-FE72-49C2-97EA-D7D86F3991EE"
          },
          {
            "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.8.0:rc2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8C4DBC6F-061B-4844-9E80-596D4890DA2A"
          },
          {
            "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.8.0:rc3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AA2C469A-7A94-4C55-9738-21C16B8C0817"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.