This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Mattermost fixes 5 vulnerabilities, 3 of them critical

Mattermost fixes 5 vulnerabilities, 3 of them critical, with versions 10.5.0, 10.4.2, 10.3.3, 10.2.3 and 9.11.8. The most serious of them are listed below; the rest can be found at [1].

Mattermost - arbitrary file read (CVE-2025-25279)
CVSS 9.1 (Critical)

An authenticated remote attacker can read any arbitrary file on the file system by importing and exporting a specially crafted archive in Boards [2].

The vulnerability is present in product:

  • *:Mattermost;>=9.11,<=9.11.7;>=10.2,<=10.2.2;>=10.3,<=10.3.2;>=10.4,<=10.4.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

More information:

  • CVE-2025-25279 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 24. 2. 2025.

Mattermost - arbitrary file read (CVE-2025-20051)
CVSS 9.1 (Critical)

Due to insufficient input validation, an authenticated remote attacker can read any arbitrary file on the file system by duplicating a specially crafted block in Boards [3].

The vulnerability is present in product:

  • *:Mattermost;>=9.11,<=9.11.7;>=10.2,<=10.2.2;>=10.3,<=10.3.2;>=10.4,<=10.4.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

More information:

  • CVE-2025-20051 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 24. 2. 2025.

Mattermost - SQL injection (CVE-2025-24490)
CVSS 9.6 (Critical)

Due to the application's failure to use prepared statements when reordering boards, an authenticated remote attacker can perform an SQL injection attack and gain unauthorized access to data from the database [4].

The vulnerability is present in product:

  • *:Mattermost;>=9.11,<=9.11.7;>=10.2,<=10.2.2;>=10.3,<=10.3.2;>=10.4,<=10.4.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

More information:

  • CVE-2025-24490 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 24. 2. 2025.

Mattermost - improper access (CVE-2025-24526)
CVSS 4.3 (Medium)

Due to an implementation error, an authenticated remote attacker can export the content of archived channels without authorization even when the "Allow users to view archived channels" option is disabled [5].

The vulnerability is present in product:

  • *:Mattermost;>=9.11,<=9.11.7;>=10.1,<=10.1.3;>=10.2,<=10.2.2;>=10.3,<=10.3.2;>=10.4,<=10.4.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

More information:

The vulnerability was publicly disclosed 24. 2. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 3. 3. 2025.

CESNET, z.s.p.o. Logo