DeutschShown in its original language — a full translation is planned for a future version.
Mattermost Server und Plugins: Mehrere Schwachstellen
view advisory published 2025-07-22
Ein authentifizierter Angreifer mit bestimmten Berechtigungen kann diese Schwachstellen ausnutzen, um Sicherheitsmechanismen zu umgehen, beliebige Dateien in das Dateisystem einzubringen und potenziell beliebigen Code auszuführen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-8402US | — | — | ||
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a system admin to crash th… | ||||
| CVE-2025-6465US | — | — | ||
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload permission to overwrite… | ||||
| CVE-2025-8023US | medium4.9 | — | ||
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fails to sanitize path traversal sequences in template file destination paths, which all… | ||||
| CVE-2025-53971US | —OT elevated | — | ||
Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members t… | ||||
| CVE-2025-49810US | medium4.3OT elevated | — | ||
Mattermost versions 10.5.x <= 10.5.8 fail to validate access controls at time of access which allows user to read a thread via AI posts | ||||
| CVE-2025-49222US | medium6.8 | — | ||
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2, 10.10.x <= 10.10.0 fail to validate upload types in remote cluster upload sessions whic… | ||||
| CVE-2025-47870US | medium4.3OT elevated | — | ||
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint… | ||||
| CVE-2025-47700US | — | — | ||
Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post… | ||||
| CVE-2025-36530US | medium4.9 | — | ||
Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restri… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan