PT-2025-30018 · Mattermost · Mattermost

Dawid Kulikowski · Published 2025-07-18 · Updated 2025-08-04 · CVE-2025-6233

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.16 Mattermost versions 10.5.x through 10.5.7 Mattermost versions 10.7.x through 10.7.3 Mattermost versions 10.8.x through 10.8.1

Description The application fails to sanitize input paths of file attachments within the bulk import JSONL file. This allows a system administrator to read arbitrary system files through a path traversal technique.

Recommendations Mattermost versions 9.11.x through 9.11.16: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mattermost versions 10.5.x through 10.5.7: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mattermost versions 10.7.x through 10.7.3: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mattermost versions 10.8.x through 10.8.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-6233

GHSA-WVW2-3JH4-4C39

GO-2025-3820

OPENSUSE-SU-2025:15405-1

Affected Products

Mattermost

References · 69

• https://osv.dev/vulnerability/CVE-2025-6233 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wvw2-3jh4-4c39 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6233 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3820 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/d38c27f96fcf754c36f231d1f2e9dbd48ad40bab · Note
• https://suse.com/security/cve/CVE-2025-4674 · Note
• https://suse.com/security/cve/CVE-2025-32019 · Note
• https://suse.com/security/cve/CVE-2025-3228 · Note
• https://t.me/cvetracker/28134 · Telegram Post
• https://suse.com/security/cve/CVE-2025-53826 · Note
• https://suse.com/security/cve/CVE-2025-53634 · Note
• https://suse.com/security/cve/CVE-2025-6023 · Note