by Kastro
Paper/Archive/CVE-2025-4981

CVE-2025-4981

Mattermost Mattermost — Path Traversal Leading to RCE by Any Authenticated Mattermost User

EPSS 1%CVSS 9.9
critical.is priorityof 100
42
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 63.3.633 × 2012.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.

Affected

ProductAffectedFixed inSource
Mattermost10.5.0 – 10.5.510.9.0CNA
Mattermost9.11.0 – 9.11.159.11.16CNA
Mattermost10.8.0 – 10.8.010.9.0CNA
Mattermost10.7.0 – 10.7.210.9.0CNA
Mattermost10.6.0 – 10.6.510.9.0CNA

Scores by source

Mattermost (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refmattermost.com/security-updates