PT-2025-26301 · Mattermost · Mattermost

Dawid Kulikowski · Published 2025-05-12 · Updated 2026-05-25 · CVE-2025-4981

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.5 Mattermost versions 9.11.x through 9.11.15 Mattermost versions 10.8.x through 10.8.0 Mattermost versions 10.7.x through 10.7.2 Mattermost versions 10.6.x through 10.6.5

Description Mattermost fails to sanitize filenames in the archive extractor, allowing authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution (RCE). This issue impacts instances where file uploads and document search by content are enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true), which are enabled by default. Approximately 97,000+ and 113,000+ potentially affected instances have been identified.

Recommendations Mattermost versions 10.5.x through 10.5.5: Update to a newer, fixed version. Mattermost versions 9.11.x through 9.11.15: Update to a newer, fixed version. Mattermost versions 10.8.x through 10.8.0: Update to a newer, fixed version. Mattermost versions 10.7.x through 10.7.2: Update to a newer, fixed version. Mattermost versions 10.6.x through 10.6.5: Update to a newer, fixed version.

Fix

RCE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2025-16018

CVE-2025-4981

GHSA-QH58-9V3J-WCJC

GO-2025-3769

OPENSUSE-SU-2025:15405-1

Affected Products

Mattermost

References · 85

• https://osv.dev/vulnerability/GO-2025-3769 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4981 · Security Note
• https://osv.dev/vulnerability/GHSA-qh58-9v3j-wcjc · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4981 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16018 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/65aec10162f612d98edf91cc66bf7e781868448b · Note
• https://suse.com/security/cve/CVE-2025-53632 · Note
• https://suse.com/security/cve/CVE-2025-47281 · Note
• https://suse.com/security/cve/CVE-2024-44906 · Note
• https://suse.com/security/cve/CVE-2025-47871 · Note
• https://suse.com/security/cve/CVE-2025-4922 · Note
• https://suse.com/security/cve/CVE-2025-52904 · Note