Improper File Validation in Mattermost Boards by Mattermost
CVE-2025-25279

9.9CRITICAL

Key Information:

Vendor
Mattermost
Status
Mattermost
Vendor
CVE Published:
24 February 2025

Summary

Mattermost suffers from a vulnerability that arises from improper validation of board blocks during board imports. This flaw allows an attacker to manipulate specially crafted import files, which could potentially lead to unauthorized access to arbitrary files on the server. Various versions of Mattermost, including 10.4.x (up to 10.4.1), 9.11.x (up to 9.11.7), 10.3.x (up to 10.3.2), and 10.2.x (up to 10.2.2), are impacted by this issue. Users are advised to take necessary precautions and update their versions to mitigate this risk.

Affected Version(s)

Mattermost 10.4.0 <= 10.4.1

Mattermost 9.11.0 <= 9.11.7

Mattermost 10.3.0 <= 10.3.2

References

https://mattermost.com/security-updates

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

visat
.