GHSA-vqwh-5jhh-vc9p

ghsaUSosv

Mattermost Server SSRF Vulnerability via the Agents Plugin

view advisory published 2025-08-21Licence: CC-BY-4.0

Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-47700US	—	0.19% (9th)	—	2025-08-21
Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-47700ADVISORY
https://pkg.go.dev/vuln/GO-2025-3906WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan