PT-2025-34196 · Mattermost · Mattermost Server+1

Juho Forsén · Published 2025-08-21 · Updated 2025-08-29 · CVE-2025-47700

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions 10.5.0 through 10.5.9

Description: Mattermost Server versions 10.5.x up to and including 10.5.9, when utilizing the Agents plugin, do not reject empty request bodies. This allows users to potentially trick others into clicking malicious links through post actions.

Recommendations: Update Mattermost Server to a version later than 10.5.9.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-47700

GHSA-VQWH-5JHH-VC9P

GO-2025-3906

Affected Products

Agents Plugin

Mattermost Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-47700 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47700 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3906 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vqwh-5jhh-vc9p · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://twitter.com/CVEnew/status/1958444194416013355 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47700 · Note
• https://t.me/CVEtracker/30567 · Telegram Post
• https://github.com/advisories/GHSA-vqwh-5jhh-vc9p · Note
• https://pkg.go.dev/vuln/GO-2025-3906 · Note
• https://twitter.com/VulmonFeeds/status/1958488966652391465 · Twitter Post