- Description
- Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory
- Source
- responsibledisclosure@mattermost.com
- NVD status
- Analyzed
- Products
- mattermost_server
CVSS 3.1
- Type
- Primary
- Base score
- 7.2
- Impact score
- 5.9
- Exploitability score
- 1.2
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- responsibledisclosure@mattermost.com
- CWE-22
- Hype score
- Not currently trending
CVE-2025-9079: Path Traversal in Mattermost, 8.0 rating❗️ A vulnerability in some versions of Mattermost allows attackers to execute arbitrary code via a malicious plugin. Search at https://t.co/NGF6IkUksf: 👉 Link: https://t.co/0qlP1CZdnN 👉 Dork: http.title:"mattermost"
@topboykrepta
5 Oct 2025
48 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-9079: Path Traversal in Mattermost, 8.0 rating❗️ A vulnerability in some versions of Mattermost allows attackers to execute arbitrary code via a malicious plugin. Search at https://t.co/hv7QKSqxTR: 👉 Link: https://t.co/JSoNGjAlqw https://t.co/6BAtBybQ2G
@Netlas_io
22 Sept 2025
3313 Impressions
13 Retweets
36 Likes
7 Bookmarks
1 Reply
0 Quotes
CVE-2025-9079 Arbitrary Code Execution via Malicious Plugin Upload in Mattermost Versions Below 10.10.2 https://t.co/ReVaHkCf4a
@VulmonFeeds
19 Sept 2025
13 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E2C0E13-B52A-4539-80B6-DC0FE8FF2E56",
"versionEndExcluding": "9.11.18",
"versionStartIncluding": "9.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B95DCAE5-07C2-46B1-B03E-ED3FB9B2C568",
"versionEndExcluding": "10.5.9",
"versionStartIncluding": "10.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE00156D-6ACB-4F8C-BFFC-03A8127199A4",
"versionEndExcluding": "10.8.4",
"versionStartIncluding": "10.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BB49CDD5-C206-4BEC-8CB5-D757DCC43208",
"versionEndExcluding": "10.9.4",
"versionStartIncluding": "10.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F3861BBC-7E0F-4782-9666-4EF12C1ABDF5",
"versionEndExcluding": "10.10.2",
"versionStartIncluding": "10.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]