PT-2025-3908 · Mattermost · Mattermost Mobile Apps

Lsibilev · Published 2025-01-15 · Updated 2025-01-16 · CVE-2025-0476

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mattermost Mobile Apps versions <=2.22.0

Description The issue arises from the mobile application's inability to properly handle specially crafted attachment names. This allows an attacker to crash the mobile app for any user who has opened a channel containing the specially crafted attachment. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For Mattermost Mobile Apps versions <=2.22.0, update to a version greater than 2.22.0 to resolve the issue. As a temporary workaround, consider avoiding channels with suspicious attachments to minimize the risk of the application crashing.

Fix

Weakness Enumeration

CWE-1287

Related Identifiers

CVE-2025-0476

Affected Products

Mattermost Mobile Apps

References · 6

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-0476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0476 · Security Note
• https://twitter.com/VulmonFeeds/status/1879817891450696185 · Twitter Post
• https://t.me/cvedetector/15553 · Telegram Post
• https://twitter.com/CVEnew/status/1879858746853359889 · Twitter Post